{ "version": "Notebook/1.0", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "aea1577b-66ca-45a5-9129-bc71bcec6bc2", "cellValue": "dashboard", "linkTarget": "parameter", "linkLabel": "Indicators Overview", "subTarget": "IndicatorsOverview", "style": "link" }, { "id": "cd12708b-f3a3-40c3-96d9-a25a8d5be239", "cellValue": "dashboard", "linkTarget": "parameter", "linkLabel": "Correlation Overview", "subTarget": "CorrelationOverview", "style": "link" }, { "id": "21156165-bccc-445b-a02c-8fa9d7006749", "cellValue": "dashboard", "linkTarget": "parameter", "linkLabel": "Live Investigation", "subTarget": "LiveInvestigation", "style": "link" }, { "id": "6959ddaf-5de3-4b40-b99a-136f3c1ecf98", "cellValue": "dashboard", "linkTarget": "parameter", "linkLabel": "Investigated Indicators", "subTarget": "InvestigatedIndicators", "style": "link" }, { "id": "0afd17d5-b698-43a9-832f-0b7527c2307e", "cellValue": "dashboard", "linkTarget": "parameter", "linkLabel": "Account Usage", "subTarget": "AccountUsage", "style": "link" } ] }, "name": "links - 1" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "Make sure that the **TeamCymruScoutCreateIncidentAndNotify** Playbook is configured to run from the **Insights Information by Indicators** panel when the overall rating of an IP is **malicious**.", "style": "info" }, "name": "text - 3" }, { "type": 1, "content": { "json": "## Indicators Overview\r\n---" }, "name": "text - 1" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "e6e7a3d8-260b-4ef7-97ae-1784587ec027", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "description": "Select time range", "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "value": { "durationMs": 604800000 } }, { "id": "86ea0c2a-08ce-4185-a6bb-8001537825a9", "version": "KqlParameterItem/1.0", "name": "IndicatorType", "label": "Indicator Type", "type": 2, "description": "Select the Indicator type", "isRequired": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "jsonData": "[\"IP\", \"Domain\"]", "timeContext": { "durationMs": 86400000 }, "defaultValue": "value::all" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IndicatorType: string, Indicator:string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutIP,\r\nCymruScoutDomain\r\n| where ('*' in ('{IndicatorType}')) or IndicatorType == '{IndicatorType}'\r\n| summarize arg_max(TimeGenerated, *) by Indicator\r\n| count\r\n", "size": 3, "showAnalytics": true, "title": "Total Indicators", "noDataMessage": "No data found.", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "Count", "exportParameterName": "TotalCount", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "sortBy": [], "tileSettings": { "titleContent": { "formatter": 0 }, "rightContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, "showBorder": false, "size": "auto" } }, "customWidth": "33", "name": "query - 0", "styleSettings": { "maxWidth": "33%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IndicatorType: string, Indicator:string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutIP,\r\nCymruScoutDomain\r\n| where ('*' in ('{IndicatorType}')) or IndicatorType == '{IndicatorType}'\r\n| where TimeGenerated >= ago(7d)\r\n| summarize arg_max(TimeGenerated, *) by Indicator\r\n| sort by TimeGenerated asc\r\n| count \r\n\r\n\r\n\r\n\r\n\r\n\r\n", "size": 3, "showAnalytics": true, "title": "Indicators Reported in Last Week", "noDataMessage": "No data found.", "showRefreshButton": true, "exportFieldName": "Count", "exportParameterName": "LastWeekCount", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 0 }, "rightContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, "showBorder": false, "size": "auto" } }, "customWidth": "33", "name": "query - 1", "styleSettings": { "maxWidth": "33%", "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IndicatorType: string, Indicator:string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutIP,\r\nCymruScoutDomain\r\n| where ('*' in ('{IndicatorType}')) or IndicatorType == '{IndicatorType}'\r\n| where TimeGenerated >= ago(1d)\r\n| summarize arg_max(TimeGenerated, *) by Indicator\r\n| sort by TimeGenerated asc\r\n| count \r\n\r\n\r\n", "size": 3, "showAnalytics": true, "title": "Indicators Reported in Last Day", "noDataMessage": "No data found.", "showRefreshButton": true, "exportFieldName": "Count", "exportParameterName": "LastDayCount", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "formatter": 0 }, "leftContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, "showBorder": false, "size": "auto" } }, "customWidth": "33", "name": "query - 2", "styleSettings": { "maxWidth": "33%", "showBorder": true } }, { "type": 1, "content": { "json": "#### Click on the count in tile **Total Indicators** above to view more information.", "style": "info" }, "customWidth": "33", "name": "text - 14" }, { "type": 1, "content": { "json": "#### Click on the count in tile **Indicators Reported in Last Week** above to view more information.", "style": "info" }, "customWidth": "33", "name": "text - 15" }, { "type": 1, "content": { "json": "#### Click on the count in tile **Indicators Reported in Last Day** above to view more information.", "style": "info" }, "customWidth": "33", "name": "text - 16" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IndicatorType: string, Indicator:string, IP: string, Domain:string, IPCountryCode:string, CountryCodes:string, InsightsOverallRating: string, SummaryWhoIsASName: string, SummaryWhoIsASN: real, SummaryWhoIsNetName: string, SummaryWhoIsOrgName: string, SummaryReverseHostNames: string, IdentityASN: real, IdentityASName: string, IdentityNetName: string, IdentityOrgName:string, ASInfo:string, IdentityReverseHostNames:string, IPPdnsDomain: string, PDNSDetails: dynamic, OpenPorts: string, OpenPortsDetails: dynamic, ProtocolID: string, ProtocolType: string, OpenPortServices: string, CertificateDetails: string, FingerprintsDetails: string, TagsIds: string, TagsNames: string, SummaryOpenPorts: string, SummaryPDNS: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutIP,\r\nCymruScoutDomain\r\n| where ('*' in ('{IndicatorType}')) or IndicatorType == '{IndicatorType}'\r\n| summarize arg_max(TimeGenerated, *) by Indicator\r\n| extend DomainCountryCodes = strcat_array(todynamic(CountryCodes), \",\")\r\n| extend ['Country Code'] = coalesce(IPCountryCode, DomainCountryCodes) \r\n| sort by TimeGenerated asc\r\n| project-reorder TimeGenerated, IndicatorType, Indicator, IP, Domain\r\n| project-away IPCountryCode, DomainCountryCodes, CountryCodes\r\n| project-rename ['Insights Overall Rating'] = InsightsOverallRating, ['Summary WhoIs ASName'] = SummaryWhoIsASName, ['Summary WhoIs ASN'] = SummaryWhoIsASN, ['Summary WhoIs Net Name'] = SummaryWhoIsNetName, ['Summary WhoIs Org Name'] = SummaryWhoIsOrgName, ['Summary Reverse Host Names'] = SummaryReverseHostNames, ['Identity ASN'] = IdentityASN, ['Identity ASName'] = IdentityASName, ['Identity Net Name'] = IdentityNetName, ['Identity Org Name'] = IdentityOrgName, ['AS Info'] = ASInfo, ['Identity Reverse Host Names'] = IdentityReverseHostNames, ['PDNS Domain'] = IPPdnsDomain, ['PDNS Details'] = PDNSDetails, ['Open Ports'] = OpenPorts, ['Open Ports Details'] = OpenPortsDetails, ['Protocol ID'] = ProtocolID, ['Protocol Type'] = ProtocolType, ['Open Port Services'] = OpenPortServices, ['Certificate Details'] = CertificateDetails, ['Fingerprints Details'] = FingerprintsDetails, ['Tags Ids'] = TagsIds, ['Tags Names'] = TagsNames, ['Summary Open Ports'] = SummaryOpenPorts, ['Summary PDNS'] = SummaryPDNS\r\n", "size": 0, "showAnalytics": true, "title": "Details of Indicators", "noDataMessage": "No data found.", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true }, "sortBy": [] }, "conditionalVisibility": { "parameterName": "TotalCount", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 8", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IndicatorType: string, Indicator:string, IP: string, Domain:string, IPCountryCode:string, CountryCodes:string, InsightsOverallRating: string, SummaryWhoIsASName: string, SummaryWhoIsASN: real, SummaryWhoIsNetName: string, SummaryWhoIsOrgName: string, SummaryReverseHostNames: string, IdentityASN: real, IdentityASName: string, IdentityNetName: string, IdentityOrgName:string, ASInfo:string, IdentityReverseHostNames:string, IPPdnsDomain: string, PDNSDetails: dynamic, OpenPorts: string, OpenPortsDetails: dynamic, ProtocolID: string, ProtocolType: string, OpenPortServices: string, CertificateDetails: string, FingerprintsDetails: string, TagsIds: string, TagsNames: string, SummaryOpenPorts: string, SummaryPDNS: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutIP,\r\nCymruScoutDomain\r\n| where ('*' in ('{IndicatorType}')) or IndicatorType == '{IndicatorType}'\r\n| where TimeGenerated >= ago(7d)\r\n| summarize arg_max(TimeGenerated, *) by Indicator\r\n| extend DomainCountryCodes = strcat_array(todynamic(CountryCodes), \",\")\r\n| extend ['Country Code'] = coalesce(IPCountryCode, DomainCountryCodes) \r\n| sort by TimeGenerated asc\r\n| project-reorder TimeGenerated, IndicatorType, Indicator, IP, Domain\r\n| project-away IPCountryCode, DomainCountryCodes, CountryCodes\r\n| project-rename ['Insights Overall Rating'] = InsightsOverallRating, ['Summary WhoIs ASName'] = SummaryWhoIsASName, ['Summary WhoIs ASN'] = SummaryWhoIsASN, ['Summary WhoIs Net Name'] = SummaryWhoIsNetName, ['Summary WhoIs Org Name'] = SummaryWhoIsOrgName, ['Summary Reverse Host Names'] = SummaryReverseHostNames, ['Identity ASN'] = IdentityASN, ['Identity ASName'] = IdentityASName, ['Identity Net Name'] = IdentityNetName, ['Identity Org Name'] = IdentityOrgName, ['AS Info'] = ASInfo, ['Identity Reverse Host Names'] = IdentityReverseHostNames, ['PDNS Domain'] = IPPdnsDomain, ['PDNS Details'] = PDNSDetails, ['Open Ports'] = OpenPorts, ['Open Ports Details'] = OpenPortsDetails, ['Protocol ID'] = ProtocolID, ['Protocol Type'] = ProtocolType, ['Open Port Services'] = OpenPortServices, ['Certificate Details'] = CertificateDetails, ['Fingerprints Details'] = FingerprintsDetails, ['Tags Ids'] = TagsIds, ['Tags Names'] = TagsNames, ['Summary Open Ports'] = SummaryOpenPorts, ['Summary PDNS'] = SummaryPDNS\r\n\r\n", "size": 0, "showAnalytics": true, "title": "Details of Indicators from Last Week", "noDataMessage": "No data found.", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "LastWeekCount", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 9", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IndicatorType: string, Indicator:string, IP: string, Domain:string, IPCountryCode:string, CountryCodes:string, InsightsOverallRating: string, SummaryWhoIsASName: string, SummaryWhoIsASN: real, SummaryWhoIsNetName: string, SummaryWhoIsOrgName: string, SummaryReverseHostNames: string, IdentityASN: real, IdentityASName: string, IdentityNetName: string, IdentityOrgName:string, ASInfo:string, IdentityReverseHostNames:string, IPPdnsDomain: string, PDNSDetails: dynamic, OpenPorts: string, OpenPortsDetails: dynamic, ProtocolID: string, ProtocolType: string, OpenPortServices: string, CertificateDetails: string, FingerprintsDetails: string, TagsIds: string, TagsNames: string, SummaryOpenPorts: string, SummaryPDNS: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutIP,\r\nCymruScoutDomain\r\n| where ('*' in ('{IndicatorType}')) or IndicatorType == '{IndicatorType}'\r\n| where TimeGenerated >= ago(1d)\r\n| summarize arg_max(TimeGenerated, *) by Indicator\r\n| extend DomainCountryCodes = strcat_array(todynamic(CountryCodes), \",\")\r\n| extend ['Country Code'] = coalesce(IPCountryCode, DomainCountryCodes) \r\n| sort by TimeGenerated asc\r\n| project-reorder TimeGenerated, IndicatorType, Indicator, IP, Domain\r\n| project-away IPCountryCode, DomainCountryCodes, CountryCodes\r\n| project-rename ['Insights Overall Rating'] = InsightsOverallRating, ['Summary WhoIs ASName'] = SummaryWhoIsASName, ['Summary WhoIs ASN'] = SummaryWhoIsASN, ['Summary WhoIs Net Name'] = SummaryWhoIsNetName, ['Summary WhoIs Org Name'] = SummaryWhoIsOrgName, ['Summary Reverse Host Names'] = SummaryReverseHostNames, ['Identity ASN'] = IdentityASN, ['Identity ASName'] = IdentityASName, ['Identity Net Name'] = IdentityNetName, ['Identity Org Name'] = IdentityOrgName, ['AS Info'] = ASInfo, ['Identity Reverse Host Names'] = IdentityReverseHostNames, ['PDNS Domain'] = IPPdnsDomain, ['PDNS Details'] = PDNSDetails, ['Open Ports'] = OpenPorts, ['Open Ports Details'] = OpenPortsDetails, ['Protocol ID'] = ProtocolID, ['Protocol Type'] = ProtocolType, ['Open Port Services'] = OpenPortServices, ['Certificate Details'] = CertificateDetails, ['Fingerprints Details'] = FingerprintsDetails, ['Tags Ids'] = TagsIds, ['Tags Names'] = TagsNames, ['Summary Open Ports'] = SummaryOpenPorts, ['Summary PDNS'] = SummaryPDNS\r\n", "size": 0, "showAnalytics": true, "title": "Details of Indicators from Last Day", "noDataMessage": "No data found.", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true }, "sortBy": [] }, "conditionalVisibility": { "parameterName": "LastDayCount", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 10", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IndicatorType: string, Indicator:string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutIP,\r\nCymruScoutDomain\r\n| summarize arg_max(TimeGenerated, *) by Indicator\r\n| where ('*' in ('{IndicatorType}')) or IndicatorType == '{IndicatorType}'\r\n| extend Date = format_datetime(todatetime(TimeGenerated), 'yyyy-MM-dd')\r\n| summarize dcount(Indicator) by Date, IndicatorType\r\n| sort by Date asc\r\n", "size": 3, "aggregation": 2, "showAnalytics": true, "title": "Indicators Ingested Over Time", "noDataMessage": "No data found.", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "x", "exportParameterName": "DateTime", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "Date", "group": "*", "createOtherGroup": 0, "showLegend": true, "xSettings": { "label": "Time" }, "ySettings": { "label": "Indicators" } } }, "name": "query - 3", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### Click on a bar in panel **Indicators Ingested Over Time** above to view more information.", "style": "info" }, "name": "text - 17" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IndicatorType: string, Indicator:string, IP: string, Domain:string, IPCountryCode:string, CountryCodes:string, InsightsOverallRating: string, SummaryWhoIsASName: string, SummaryWhoIsASN: real, SummaryWhoIsNetName: string, SummaryWhoIsOrgName: string, SummaryReverseHostNames: string, IdentityASN: real, IdentityASName: string, IdentityNetName: string, IdentityOrgName:string, ASInfo:string, IdentityReverseHostNames:string, IPPdnsDomain: string, PDNSDetails: dynamic, OpenPorts: string, OpenPortsDetails: dynamic, ProtocolID: string, ProtocolType: string, OpenPortServices: string, CertificateDetails: string, FingerprintsDetails: string, TagsIds: string, TagsNames: string, SummaryOpenPorts: string, SummaryPDNS: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutIP,\r\nCymruScoutDomain\r\n| where ('*' in ('{IndicatorType}')) or IndicatorType == '{IndicatorType}'\r\n| summarize arg_max(TimeGenerated, *) by Indicator\r\n| extend Date = format_datetime(todatetime(TimeGenerated), 'yyyy-MM-dd')\r\n| where Date == '{DateTime}'\r\n| extend DomainCountryCodes = strcat_array(todynamic(CountryCodes), \",\")\r\n| extend ['Country Code'] = coalesce(IPCountryCode, DomainCountryCodes) \r\n| project-reorder TimeGenerated, IndicatorType, Indicator, IP, Domain\r\n| project-away IPCountryCode, DomainCountryCodes, CountryCodes, Date\r\n| project-rename ['Insights Overall Rating'] = InsightsOverallRating, ['Summary WhoIs ASName'] = SummaryWhoIsASName, ['Summary WhoIs ASN'] = SummaryWhoIsASN, ['Summary WhoIs Net Name'] = SummaryWhoIsNetName, ['Summary WhoIs Org Name'] = SummaryWhoIsOrgName, ['Summary Reverse Host Names'] = SummaryReverseHostNames, ['Identity ASN'] = IdentityASN, ['Identity ASName'] = IdentityASName, ['Identity Net Name'] = IdentityNetName, ['Identity Org Name'] = IdentityOrgName, ['AS Info'] = ASInfo, ['Identity Reverse Host Names'] = IdentityReverseHostNames, ['PDNS Domain'] = IPPdnsDomain, ['PDNS Details'] = PDNSDetails, ['Open Ports'] = OpenPorts, ['Open Ports Details'] = OpenPortsDetails, ['Protocol ID'] = ProtocolID, ['Protocol Type'] = ProtocolType, ['Open Port Services'] = OpenPortServices, ['Certificate Details'] = CertificateDetails, ['Fingerprints Details'] = FingerprintsDetails, ['Tags Ids'] = TagsIds, ['Tags Names'] = TagsNames, ['Summary Open Ports'] = SummaryOpenPorts, ['Summary PDNS'] = SummaryPDNS\r\n", "size": 0, "showAnalytics": true, "title": "Details of Indicators Ingested Over Time", "noDataMessage": "No data found.", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "DateTime", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 11", "styleSettings": { "showBorder": true } }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "bcce6bdc-6170-436b-8eac-2b106bc8368f", "version": "KqlParameterItem/1.0", "name": "Indicators", "type": 2, "description": "Select Indicator value", "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "query": "let dummy_table = datatable(IndicatorType: string, Indicator:string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutIP,\r\nCymruScoutDomain\r\n| where ('*' in ('{IndicatorType}')) or IndicatorType == '{IndicatorType}'\r\n| distinct Indicator", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "defaultValue": "value::all", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 4" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IndicatorType: string, Indicator:string, IP: string, Domain:string, ASInfo:string, SummaryWhoIsASName:string, IdentityASName:string, SummaryWhoIsASN: real, IdentityASN: real, SummaryWhoIsNetName: string, IdentityNetName: string, SummaryWhoIsOrgName: string, IdentityOrgName: string, SummaryReverseHostNames:string, IdentityReverseHostNames:string, TagsIds: string, TagsNames: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutIP,\r\nCymruScoutDomain\r\n| where ('*' in ('{IndicatorType}')) or IndicatorType == '{IndicatorType}'\r\n| where ('*' in ({Indicators})) or (Indicator in ({Indicators}))\r\n| summarize arg_max(TimeGenerated, *) by Indicator\r\n| mv-apply todynamic(ASInfo) on ( summarize ASName = make_list(ASInfo.as_name), ASN = make_list(ASInfo.asn) by IP, Indicator)\r\n| extend ['AS Name'] = coalesce(SummaryWhoIsASName,IdentityASName, strcat_array(ASName, \",\")),\r\n ASN = coalesce(tostring(toint(SummaryWhoIsASN)), tostring(toint(IdentityASN)), strcat_array(ASN, \",\")), \r\n ['Net Name'] = coalesce(SummaryWhoIsNetName, IdentityNetName, 'N/A'),\r\n ['Organization Name'] = coalesce(SummaryWhoIsOrgName, IdentityOrgName, 'N/A'),\r\n ['Reverse Hostnames'] = coalesce(SummaryReverseHostNames, IdentityReverseHostNames, 'N/A'),\r\n ['Tags Ids'] = coalesce(TagsIds, 'N/A'),\r\n ['Tags Name'] = coalesce(TagsNames, 'N/A')\r\n| project Indicator, ['AS Name'] = iff(['AS Name'] == \"\", \"N/A\",['AS Name']), ASN = iff(ASN == \"\", \"N/A\",ASN), ['Net Name'], ['Organization Name'], ['Reverse Hostnames'], ['Tags Ids'], ['Tags Name'] \r\n", "size": 0, "showAnalytics": true, "title": "Identity Information by Indicators", "noDataMessage": "No data found.", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 5", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "## Steps to Create Incident and Notify for a Malicious Indicator.\r\n- Select the **Subscription ID** and **Resource Group**.\r\n- Click on the **Run Playbook** button besides malicious indicator.\r\n- One side panel will be open, click on the **Create Incident And Notify** button below.\r\n- This will execute the **TeamCymruScoutCreateIncidentAndNotify** logic app in the background.\r\n- You can check the status of the playbook to identify the creation of incident and check mail for notification.\r\n
\r\n
\r\n**NOTE**: You can see Run Playbook option visible only for Malicious indicators. For others, that option is not available.\r\n", "style": "upsell" }, "name": "text - 13" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "3f0a0cc5-3490-430c-b62b-bd6f398abd6f", "version": "KqlParameterItem/1.0", "name": "SubscriptionId", "label": "Subscription ID", "type": 2, "description": "Select Subscription ID", "isRequired": true, "query": "Resources\r\n| distinct subscriptionId", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null }, { "id": "cff3bb6e-4bd5-4874-a32d-3706601bbaf9", "version": "KqlParameterItem/1.0", "name": "ResourceGroup", "label": "Resource Group", "type": 2, "description": "Select Resource Group", "isRequired": true, "query": "Resources \r\n| extend ResourceGroupName = resourceGroup \r\n| distinct ResourceGroupName", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null } ], "style": "pills", "queryType": 1, "resourceType": "microsoft.resourcegraph/resources" }, "name": "parameters - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IndicatorType: string, Indicator:string, InsightsOverallRating: string, Insights: string) [];\r\nlet OverviewTable=(\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutIP,\r\nCymruScoutDomain\r\n| where ('*' in ('{IndicatorType}')) or IndicatorType == '{IndicatorType}'\r\n| where ('*' in ({Indicators})) or (Indicator in ({Indicators}))\r\n| summarize arg_max(TimeGenerated, *) by Indicator\r\n|project Indicator, [\"Insights Overall Rating\"] = coalesce(InsightsOverallRating, 'N/A')\r\n);\r\nlet InsightsMessageTable=(\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutIP,\r\nCymruScoutDomain\r\n| where ('*' in ('{IndicatorType}')) or IndicatorType == '{IndicatorType}'\r\n| where ('*' in ({Indicators})) or (Indicator in ({Indicators}))\r\n| mv-expand todynamic(Insights)\r\n| extend insight_message = Insights.message, \r\n insight_rating = Insights.rating\r\n| extend Message = iff(isnotnull(insight_message) and isnotnull(insight_rating),strcat(insight_message, \"->\", insight_rating), 'N/A')\r\n| summarize ['Insight Message With Rating'] = make_set(Message) by Indicator\r\n| project Indicator, ['Insight Message With Rating'] = iff(['Insight Message With Rating'] == '[\"N/A\"]', \"N/A\",strcat_array(['Insight Message With Rating'], \",\"))\r\n);\r\nInsightsMessageTable | join kind=fullouter OverviewTable on Indicator\r\n| extend ['Create Incident And Notify'] = iff(tolower([\"Insights Overall Rating\"]) in (\"malicious\", \"suspicious\"), \"Run Playbook\", \"\")\r\n| project Indicator, ['Insight Message With Rating'], [\"Insights Overall Rating\"], ['Create Incident And Notify']", "size": 0, "showAnalytics": true, "title": "Insights Information by Indicators", "noDataMessage": "No data found.", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "Indicator", "exportParameterName": "Indicator", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Indicator", "formatter": 7, "formatOptions": { "linkTarget": "GenericDetails", "linkIsContextBlade": true } }, { "columnMatch": "Insights Overall Rating", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "suspicious", "representation": "orange", "text": "{0}{1}" }, { "operator": "==", "thresholdValue": "malicious", "representation": "red", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": null, "text": "{0}{1}" } ] }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, { "columnMatch": "Create Incident And Notify", "formatter": 7, "formatOptions": { "linkTarget": "ArmAction", "linkLabel": "", "linkIsContextBlade": true, "armActionContext": { "path": "/subscriptions/{SubscriptionId}/resourceGroups/{ResourceGroup}/providers/Microsoft.Logic/workflows/TeamCymruScoutCreateIncidentAndNotify/triggers/manual/run?api-version=2016-10-01", "headers": [], "params": [], "body": "{\r\n \"indicator_value\": \"{Indicator}\",\r\n \"fetch_from_logs\": true,\r\n \"time_range\": \"{TimeRange}\"\r\n}", "httpMethod": "POST", "description": "# Actions can potentially modify resources.\n## Please use caution and include a confirmation message in this description when authoring this command.", "runLabel": "Create Incident And Notify" } } } ], "rowLimit": 10000, "filter": true } }, "name": "query - 3", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IndicatorType: string, Indicator:string, IP: string, SummaryOpenPorts: string, SummaryPDNS:string, OpenPorts: string, ProtocolID: string, ProtocolType: string, OpenPortServices: string, IPPdnsDomain:string, CertificateDetails:string, FingerprintsDetails: string, PDNSDetails: dynamic, OpenPortsDetails: dynamic) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutIP,\r\nCymruScoutDomain\r\n| where ('*' in ('{IndicatorType}')) or IndicatorType == '{IndicatorType}'\r\n| where ('*' in ({Indicators})) or (Indicator in ({Indicators}))\r\n| extend DomainOpenPorts = SummaryOpenPorts, DomainPDNS = SummaryPDNS\r\n| mv-apply todynamic(SummaryOpenPorts) on ( summarize OpenPortsDomain = strcat_array(make_list(SummaryOpenPorts.port), \",\"), DomainProtocolID = strcat_array(make_list(SummaryOpenPorts.protocol), \",\"), ProtocolTypeDomain = strcat_array(make_list(SummaryOpenPorts.protocol_text), \",\"),OpenPortServicesDomain = strcat_array(make_list(SummaryOpenPorts.service), \",\") by IP)\r\n| mv-apply todynamic(SummaryPDNS) on ( summarize DomainPdnsDomain = strcat_array(make_list(SummaryPDNS.domain), \",\"), DomainPdnsIPs = strcat_array(make_list(SummaryPDNS.ip), \",\") by IP)\r\n| extend [\"Open Ports\"] = coalesce(OpenPortsDomain, OpenPorts, \"NA\"),\r\n [\"Protocol ID\"] = coalesce(DomainProtocolID,ProtocolID, \"NA\"),\r\n ['Protocol Type'] = coalesce(ProtocolTypeDomain,ProtocolType, \"NA\"),\r\n ['Open Port Services'] = coalesce(OpenPortServicesDomain, OpenPortServices, \"NA\"), \r\n ['Pdns Domain'] = coalesce(DomainPdnsDomain,IPPdnsDomain, \"NA\"), \r\n ['Pdns IPs'] = coalesce(DomainPdnsIPs, \"NA\"),\r\n Certificate = coalesce(CertificateDetails, 'NA'),\r\n Fingerprint = coalesce(FingerprintsDetails, 'NA'),\r\n ['PDNS Details'] = coalesce(DomainPDNS, PDNSDetails, 'NA'),\r\n ['Open Ports Details'] = coalesce(DomainOpenPorts, OpenPortsDetails, 'NA')\r\n| project Indicator, [\"Open Ports\"],\r\n ['Open Port Services'],\r\n [\"Protocol ID\"],\r\n ['Protocol Type'], \r\n ['Pdns Domain'], \r\n ['Pdns IPs'], \r\n Fingerprint,\r\n Certificate,\r\n ['Open Ports Details'],\r\n ['PDNS Details']\r\n", "size": 0, "showAnalytics": true, "title": "Indicators Details", "noDataMessage": "No data found.", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Indicator", "formatter": 7, "formatOptions": { "linkTarget": "GenericDetails", "linkIsContextBlade": true } }, { "columnMatch": "PDNS Details", "formatter": 5 }, { "columnMatch": "Open Ports Details", "formatter": 5 } ], "rowLimit": 10000, "filter": true } }, "name": "query - 7", "styleSettings": { "showBorder": true } } ] }, "name": "group - 1" }, { "type": 1, "content": { "json": "📝***Refresh the web page to fetch details of recently collected events***" }, "name": "text - 4" } ] }, "conditionalVisibility": { "parameterName": "dashboard", "comparison": "isEqualTo", "value": "IndicatorsOverview" }, "name": "group - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "This workbook depends on the **TeamCymruScoutLiveInvestigation** logic app which is deployed with the Microsoft Sentinel Solution.
\r\nPlease configure this logic app first and keep it enabled in order to use this workbook.\r\n", "style": "info" }, "name": "text - 6" }, { "type": 1, "content": { "json": "## Live Investigation\r\n---" }, "name": "text - 0" }, { "type": 1, "content": { "json": "## Steps to perform Live Investigation using this workbook\r\n- This workbook is intended to help perform Live Investigation for Indicators (**Type:** IP or Domain).\r\n- Select the **Time Range** to define the investigation period. The chosen time range will be passed to the **TeamCymruScoutLiveInvestigation** logic app and used in the API call to specify the period for the investigation.\r\n- Select the **Resource Group** and **Subscription ID**.\r\n- Select Indicator Type from Type filter and provide Indicator value corresponding to it's type in the Indicator parameter.\r\n- If the selected Indicator Type is **IP**, the **Create Incident for** filter will appear, allowing to select multiple options, such as Suspicious, Malicious.\r\n- Click on the **Submit** button.\r\n- One side panel will be open, click on the **Get Data** button below.\r\n- This will execute the **TeamCymruScoutLiveInvestigation** logic app in the background.\r\n- You will be able to see a message as **Refresh to check for data availability**.\r\n- Click on the refresh button icon above the message until you get a message as **Click here to view the data**.\r\n- Click on the message **Click here to view the data** and it will display all panels for searched Indicator data.\r\n- You can check the status of the playbook to identify the Live Investigation data fetch status.\r\n
\r\n
\r\n**Note** :
\r\nIn cases where\r\n\t* In a new environment for live investigations, it may take around 5 to 10 minutes for data ingestion and dashboard population due to Sentinel's default behavior.
\r\n * Panels do not populate, please check the status of the **TeamCymruScoutLiveInvestigation** logic app.
\r\n * It is suggested to perform a **Hard Refresh** before getting Live Investigation data for the new Indicator value. Otherwise, the source drill down panels will not be populated properly.", "style": "upsell" }, "name": "text - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "56a4d330-e14d-4c1d-8aee-1672b959da7c", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "description": "Select the Time Range for Scout API call", "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 86400000 }, { "durationMs": 604800000 }, { "durationMs": 2592000000 } ], "allowCustom": true }, "value": { "durationMs": 86400000 } }, { "id": "28bfef2b-0ff8-4fa2-b3e2-07d5f187582a", "version": "KqlParameterItem/1.0", "name": "SubscriptionId", "label": "Subscription ID", "type": 2, "isRequired": true, "query": "Resources\r\n| distinct subscriptionId", "typeSettings": { "additionalResourceOptions": [] }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null }, { "id": "72afd41e-3563-490d-9981-814a9bcfa3a7", "version": "KqlParameterItem/1.0", "name": "ResourceGroup", "label": "Resource Group", "type": 2, "isRequired": true, "query": "Resources\r\n| extend ResourceGroupName = resourceGroup\r\n| distinct ResourceGroupName", "typeSettings": { "additionalResourceOptions": [] }, "timeContext": { "durationMs": 86400000 }, "queryType": 1, "resourceType": "microsoft.resourcegraph/resources", "value": null }, { "id": "af011bee-f01b-428a-9a30-f2878107082b", "version": "KqlParameterItem/1.0", "name": "IndicatorType", "label": "Indicator Type", "type": 2, "description": "Select the type of Indicator", "isRequired": true, "typeSettings": { "additionalResourceOptions": [] }, "jsonData": "[\"IP\", \"Domain\"]", "timeContext": { "durationMs": 86400000 }, "value": null }, { "id": "f19fc953-11fd-41c2-aa24-d4c2724d1530", "version": "KqlParameterItem/1.0", "name": "Indicator", "type": 1, "description": "Enter Indicator value", "isRequired": true, "timeContext": { "durationMs": 86400000 }, "value": "" }, { "id": "b067b1b0-12f0-4ee0-ac1a-eb90f2168260", "version": "KqlParameterItem/1.0", "name": "IndicatorValue", "label": "Indicator Value", "type": 1, "query": "print(replace_string(replace_string('{Indicator}','[',''),']', ''))", "isHiddenWhenLocked": true, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "0", "name": "parameters - 1" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "79935460-b901-42be-8e79-9038a6462a3b", "version": "KqlParameterItem/1.0", "name": "CreateIncidentfor", "label": "Create Incident for", "type": 2, "description": "Select the Overall Rating for Creating Incident", "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n {\"label\": \"Suspicious\", \"value\": \"suspicious\"},\r\n {\"label\": \"Malicious\", \"value\": \"malicious\"}\r\n]", "timeContext": { "durationMs": 86400000 }, "value": [ "suspicious", "malicious" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "customWidth": "23", "conditionalVisibilities": [ { "parameterName": "IndicatorType", "comparison": "isEqualTo", "value": "IP" }, { "parameterName": "Indicator", "comparison": "isNotEqualTo" } ], "name": "parameters - 2" }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "paragraph", "links": [ { "id": "27ac3723-3820-46ae-8881-a42057443f49", "linkTarget": "ArmAction", "linkLabel": "Submit", "postText": "", "style": "primary", "linkIsContextBlade": true, "armActionContext": { "path": "/subscriptions/{SubscriptionId}/resourceGroups/{ResourceGroup}/providers/Microsoft.Logic/workflows/TeamCymruScoutLiveInvestigation/triggers/manual/run?api-version=2016-10-01", "headers": [], "params": [], "body": "{\r\n \"indicator_type\": \"{IndicatorType}\",\r\n \"indicator_value\": \"{Indicator}\",\r\n \"create_incident_for\": \"{CreateIncidentfor}\",\r\n \"start_date\": \"{TimeRange:startISO}\",\r\n \"end_date\": \"{TimeRange:endISO}\"\r\n}", "httpMethod": "POST", "title": "Search Live Investigation For Indicator \"{Indicator}\"", "description": "This Action Will fetch live data from cymru scout platform to populate this dashboard.", "actionName": "Playbook Triggered Successfully.", "runLabel": "Get Data" } } ] }, "customWidth": "77", "conditionalVisibilities": [ { "parameterName": "Indicator", "comparison": "isNotEqualTo" }, { "parameterName": "SubscriptionId", "comparison": "isNotEqualTo" }, { "parameterName": "ResourceGroup", "comparison": "isNotEqualTo" }, { "parameterName": "IndicatorType", "comparison": "isNotEqualTo" } ], "name": "links - 2", "styleSettings": { "margin": "11px" } } ], "exportParameters": true }, "name": "group - 6" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, ip_s: string, query_s:string) [];\r\nunion isfuzzy=true dummy_table, \r\n(Summary_Details_CL| where '{IndicatorType}' == \"IP\"|where ip_s == '{IndicatorValue}') , \r\n(Domain_Data_CL| where '{IndicatorType}' == 'Domain'| where query_s == '{IndicatorValue}')\r\n| summarize count()\r\n| extend status = case(count_ == 0 , \"Refresh to check for data availability\",\"Click here to populate data.\")\r\n| project status", "size": 3, "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "exportFieldName": "status", "exportParameterName": "status", "exportDefaultValue": "", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "status" }, "showBorder": false, "size": "full" } }, "customWidth": "30", "conditionalVisibilities": [ { "parameterName": "SubscriptionId", "comparison": "isNotEqualTo" }, { "parameterName": "ResourceGroup", "comparison": "isNotEqualTo" }, { "parameterName": "IndicatorType", "comparison": "isNotEqualTo" }, { "parameterName": "Indicator", "comparison": "isNotEqualTo" } ], "name": "query - 5", "styleSettings": { "margin": "28px" } }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "a5a1e7fd-8177-4055-93e0-5a2ada1e60c9", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Summary", "subTarget": "summary", "style": "link" }, { "id": "125ea9d0-d286-4248-a1e5-02add32ccd58", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Communications", "subTarget": "communications", "style": "link" }, { "id": "851a074d-9cfd-427a-9e50-6efca9a8d3da", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Open Ports", "subTarget": "openports", "style": "link" }, { "id": "26d316a2-f3d2-4c8b-872f-a582df1423db", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "PDNS", "subTarget": "pdns", "style": "link" }, { "id": "8fd0697e-4c61-46ac-a0e0-c0a6e29bdb46", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "X.509", "subTarget": "x509", "style": "link" }, { "id": "39bbecc4-df58-4663-8c42-7bdc8903d9ba", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Fingerprints", "subTarget": "fingerprints", "style": "link" }, { "id": "bb617578-5e0c-454b-a9b6-7ce772b69dc2", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Whois", "subTarget": "whois", "style": "link" } ] }, "conditionalVisibility": { "parameterName": "IndicatorType", "comparison": "isEqualTo", "value": "IP" }, "name": "links - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Identity Details - \"{IndicatorValue}\"", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, ['Overall Rating']: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutSummary\r\n| where IP == '{IndicatorValue}'\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| extend Overall_Rating = case(\r\n tolower(['Overall Rating']) == \"suspicious\", \"⚠ Suspicious\",\r\n tolower(['Overall Rating']) == \"malicious\", \"ⓘ Malicious\",\r\n \"No Rating\")\r\n| project ['Overall Rating'] = Overall_Rating", "size": 3, "title": "Overall Rating", "noDataMessage": "No Overall rating found", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Overall Rating", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "contains", "thresholdValue": "Suspicious", "representation": "orange", "text": "{0}{1}" }, { "operator": "contains", "thresholdValue": "Malicious", "representation": "redBright", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "text": "{0}{1}" } ] }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, "showBorder": false, "sortOrderField": 1, "size": "auto" } }, "customWidth": "50", "name": "query - 0", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, ['Geo IP CC']:string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutSummary\r\n| where IP == '{IndicatorValue}'\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| extend Country = iif(isempty(['Geo IP CC']), \"NA\", ['Geo IP CC'])", "size": 3, "title": "Country", "noDataMessage": "No Associated Country found", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Country", "formatter": 12, "formatOptions": { "palette": "none" } }, "showBorder": false, "size": "auto" } }, "customWidth": "50", "name": "query - 1", "styleSettings": { "margin": "1px", "padding": "3px", "showBorder": true } } ] }, "name": "group - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, ['Org Name']: string, [\"Net Name\"]: string, ['As Name']: string, Asn: real) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutIdentity\r\n| where IP == '{IndicatorValue}'\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| project [\"Organization Name\"]=['Org Name'], [\"Net Name\"], [\"AS Name\"] = ['As Name'], [\"ASN\"]=Asn", "size": 0, "showAnalytics": true, "title": "Organization Details for \"{IndicatorValue}\"", "noDataMessage": "No Organization data found", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "customWidth": "50", "name": "query - 1", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, Insights:string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutSummary\r\n| where IP == '{IndicatorValue}'\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| mv-expand todynamic(Insights)\r\n| project ['Insights']=Insights.message", "size": 0, "showAnalytics": true, "title": "Insights Information for \"{IndicatorValue}\"", "noDataMessage": "No Insights found", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Insights", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "100%" } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "50", "name": "query - 5", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string) [];\r\nlet dummy_table2 = datatable(TimeGenerated: datetime, IP: string, Port: real, Service: string, Protocol: real, ['Protocol Name']: string, ['First Seen']: string, ['Last Seen']: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutSummary\r\n| where IP == \"{IndicatorValue}\"\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| join kind=inner (union isfuzzy=true dummy_table2, CymruScoutSummaryTopOpenPorts | summarize arg_max(TimeGenerated, *) by IP, Port, Protocol) on $left.IP == $right.IP\r\n| project ['Protocol']=['Protocol Name'], Port, Service, ['First Seen']=format_datetime(todatetime(['First Seen']), \"yyyy-MM-dd\"), ['Last Seen']=format_datetime(todatetime(['Last Seen']), \"yyyy-MM-dd\")\r\n| sort by ['Last Seen'] desc", "size": 0, "showAnalytics": true, "title": "Open Ports for \"{IndicatorValue}\"", "noDataMessage": "No Open Ports found", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Service", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "10%" } }, { "columnMatch": "First Seen", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15%" } }, { "columnMatch": "Last Seen", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15%" } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "50", "name": "query - 6", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string) [];\r\nlet dummy_table2 = datatable(TimeGenerated: datetime, IP: string, Domain: string, ['Event Count']: real) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutSummary\r\n| where IP == \"{IndicatorValue}\"\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| join kind=inner (union isfuzzy=true dummy_table2, CymruScoutSummaryTopPdns | summarize arg_max(TimeGenerated, *) by IP, Domain) on $left.IP == $right.IP\r\n| project Domain, ['Event Count']\r\n| sort by toint(['Event Count']) desc", "size": 0, "showAnalytics": true, "title": "Most Observed Domains for \"{IndicatorValue}\"", "noDataMessage": "No Domain found", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Domain", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "80%" } }, { "columnMatch": "Event Count", "formatter": 4, "formatOptions": { "palette": "greenRed" } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "50", "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, Port: real, MD5: string, Subject: string, Issuer: string, ['Valid Days']: real, [\"Not Before\"]: string, [\"Not After\"]: string, SHA1: string, SHA256: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutSummaryTopCerts\r\n| where IP == \"{IndicatorValue}\"\r\n| summarize arg_max(TimeGenerated,*), Ports = make_set_if(toint(Port), isnotempty(Port)) by Issuer, Subject, ['Not After'], ['Not Before'], MD5, ['Valid Days'], SHA1, SHA256\r\n| extend Ports = strcat_array(Ports, \", \")\r\n| project\r\n Subject,\r\n Issuer,\r\n Ports,\r\n [\"Validity Period\"] = ['Valid Days'],\r\n [\"Not Before\"],\r\n [\"Not After\"],\r\n MD5,\r\n SHA1,\r\n SHA256", "size": 0, "showAnalytics": true, "title": "Certificate Details for \"{IndicatorValue}\"", "noDataMessage": "No Certificate Details found", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 5", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, ['Signature G']: string, ['Signature S']: string, ['Signature Type']: string, ['First Seen']: string, ['Last Seen']: string, Port: real) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutSummaryTopFingerprints\r\n| where IP == \"{IndicatorValue}\"\r\n| extend Signature = coalesce(['Signature G'], ['Signature S'])\r\n| summarize arg_max(TimeGenerated, *) by IP, Signature, Port\r\n| project\r\n Type = ['Signature Type'],\r\n Signature,\r\n ['First Seen'] = format_datetime(todatetime(['First Seen']), \"yyyy-MM-dd\"),\r\n ['Last Seen'] = format_datetime(todatetime(['Last Seen']), \"yyyy-MM-dd\"),\r\n Port\r\n| sort by ['Last Seen'] desc", "size": 0, "showAnalytics": true, "title": "Most Observed Fingerprints", "noDataMessage": "No Fingerprints found", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Signature", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "50%" } } ], "rowLimit": 10000, "filter": true } }, "name": "query - 6", "styleSettings": { "showBorder": true } }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "70b2d043-ae23-41b3-bee1-1e6c55239d88", "cellValue": "subpanel", "linkTarget": "parameter", "linkLabel": "Overview", "subTarget": "overview", "style": "link" }, { "id": "1e014924-becc-4000-9f76-283dc725d77e", "cellValue": "subpanel", "linkTarget": "parameter", "linkLabel": "Communications", "subTarget": "communications", "style": "link" }, { "id": "8e8df187-daca-4dbc-843b-d504d58a0633", "cellValue": "subpanel", "linkTarget": "parameter", "linkLabel": "Services", "subTarget": "services", "style": "link" }, { "id": "394bd6fd-0d88-4bf9-a013-74451d9ca265", "cellValue": "subpanel", "linkTarget": "parameter", "linkLabel": "Tags", "subTarget": "tags", "style": "link" }, { "id": "db35d66c-f096-4792-8f11-9a3104deacf2", "cellValue": "subpanel", "linkTarget": "parameter", "linkLabel": "ASNs", "subTarget": "asns", "style": "link" }, { "id": "9a6a2a5f-c505-4941-abb8-4bf74afcfdf3", "cellValue": "subpanel", "linkTarget": "parameter", "linkLabel": "Countries", "subTarget": "countries", "style": "link" } ] }, "name": "links - 7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string) [];\r\nlet dummy_table2 = datatable(TimeGenerated: datetime, IP: string, Domain: string, Service: string, ['First Seen']: string, ['Last Seen']: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutSummary\r\n| where IP == \"{IndicatorValue}\"\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| join kind=inner (union isfuzzy=true dummy_table2, CymruScoutSummaryTopPdns| summarize arg_max(TimeGenerated, *) by IP, Domain) on $left.IP == $right.IP\r\n| project Domain, ['First Seen']=format_datetime(todatetime(['First Seen']), \"yyyy-MM-dd\"), ['Last Seen']=format_datetime(todatetime(['Last Seen']), \"yyyy-MM-dd\")\r\n| extend Duration = range(todatetime(['First Seen']), todatetime(['Last Seen']), 1d) \r\n| mv-expand Duration \r\n| project Domain, Timestamp = Duration \r\n| summarize count() by tostring(Domain), bin(todatetime(Timestamp), 1d)", "size": 0, "aggregation": 2, "showAnalytics": true, "title": "PDNS", "noDataMessage": "No PDNS found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "xAxis": "Timestamp", "showLegend": true, "xSettings": { "label": "Date" } } }, "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, ['Tag Timeline Data']: string, ['First Seen']: string, ['Last Seen']: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutSummary\r\n| where IP == '{IndicatorValue}'\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| mv-expand todynamic(['Tag Timeline Data'])\r\n| extend Tags = ['Tag Timeline Data'].tag.name\r\n| project Tags, ['First Seen']=format_datetime(todatetime(['Tag Timeline Data'].first_seen), \"yyyy-MM-dd\"), ['Last Seen']=format_datetime(todatetime(['Tag Timeline Data'].last_seen), \"yyyy-MM-dd\")\r\n| extend Duration = range(todatetime(['First Seen']), todatetime(['Last Seen']), 1d) \r\n| mv-expand Duration \r\n| project Tags, Timestamp = Duration \r\n| summarize count() by tostring(Tags), bin(todatetime(Timestamp), 1d)", "size": 0, "aggregation": 2, "showAnalytics": true, "title": "Tags", "noDataMessage": "No Tags found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "xAxis": "Timestamp", "showLegend": true } }, "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string) [];\r\nlet dummy_table2 = datatable(TimeGenerated: datetime, IP: string, Port: real, Protocol: real, ['First Seen']: string, ['Last Seen']: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutSummary\r\n| where IP == \"{IndicatorValue}\"\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| join kind=inner (union isfuzzy=true dummy_table2, CymruScoutSummaryTopOpenPorts| summarize arg_max(TimeGenerated, *) by IP, Port, Protocol) on $left.IP == $right.IP\r\n| project Port, ['First Seen']=format_datetime(todatetime(['First Seen']), \"yyyy-MM-dd\"), ['Last Seen']=format_datetime(todatetime(['Last Seen']), \"yyyy-MM-dd\")\r\n| extend Duration = range(todatetime(['First Seen']), todatetime(['Last Seen']), 1d) \r\n| mv-expand Duration \r\n| project Port, Timestamp = Duration \r\n| summarize Count = count() by tostring(toint(Port)), bin(todatetime(Timestamp), 1d)", "size": 0, "aggregation": 2, "showAnalytics": true, "title": "Open Ports", "noDataMessage": "No Open Ports found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "xAxis": "Timestamp", "yAxis": [ "Count" ], "group": "Port", "createOtherGroup": 0, "showLegend": true, "xSettings": { "label": "Date" }, "ySettings": { "label": "No. Of Ports" } } }, "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, MD5: string, Port: real, Subject: string, Issuer: string, ['First Seen']: string, ['Last Seen']: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutSummaryTopCerts\r\n| where IP == '{IndicatorValue}'\r\n| summarize arg_max(TimeGenerated, *) by IP, Port, MD5\r\n| extend Subject = strcat(Subject, Issuer, \"=\", Port)\r\n| project Subject, ['First Seen']=format_datetime(todatetime(['First Seen']), \"yyyy-MM-dd\"), ['Last Seen']=format_datetime(todatetime(['Last Seen']), \"yyyy-MM-dd\")\r\n| extend Duration = range(todatetime(['First Seen']), todatetime(['Last Seen']), 1d) \r\n| mv-expand Duration \r\n| project Subject, Timestamp = Duration\r\n| summarize Count = count() by Subject, bin(todatetime(Timestamp), 1d)\r\n| top 100 by Timestamp", "size": 0, "aggregation": 2, "showAnalytics": true, "title": "Certificate", "noDataMessage": "No Certificate found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "xAxis": "Timestamp", "yAxis": [ "Count" ], "group": "Subject", "createOtherGroup": 0, "showLegend": true } }, "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, ['Proto By Date']: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutProtoByIP\r\n| where IP == '{IndicatorValue}'\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| mv-expand todynamic(['Proto By Date'])\r\n| mv-expand todynamic(['Proto By Date'].data)\r\n| parse-where ['Proto By Date_data'] with * '\"count\":' Count ',\"date\":\"' dates '\"}'\r\n| extend Date = format_datetime( todatetime(dates), \"yyyy-MM-dd\")\r\n| summarize counts = sum(tolong(Count)) by Date", "size": 0, "aggregation": 2, "showAnalytics": true, "title": "Events", "noDataMessage": "No Events Found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Date", "formatter": 1 }, "leftContent": { "columnMatch": "counts", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "Date", "formatter": 1 }, "centerContent": { "columnMatch": "counts", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "xAxis": "Date", "yAxis": [ "counts" ], "createOtherGroup": 0, "xSettings": { "label": "Date" }, "ySettings": { "label": "No. of Events" } }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "counts", "sizeAggregation": "Sum", "legendMetric": "counts", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "counts", "heatmapPalette": "greenRed" } } }, "name": "query - 4" } ] }, "conditionalVisibility": { "parameterName": "subpanel", "comparison": "isEqualTo", "value": "overview" }, "name": "group - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, ['Proto By Date']: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutProtoByIP\r\n| where IP == '{IndicatorValue}'\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| mv-expand todynamic(['Proto By Date'])\r\n| mv-expand todynamic(['Proto By Date'].data)\r\n| parse-where ['Proto By Date_data'] with * '\"count\":' Count ',\"date\":\"' dates '\"}'\r\n| extend Date = format_datetime( todatetime(dates), \"yyyy-MM-dd\")\r\n| summarize counts = sum(tolong(Count)) by Date, keyword = tostring(['Proto By Date'].keyword)", "size": 0, "aggregation": 2, "showAnalytics": true, "title": "Protocols for {IndicatorValue} and Its Peers", "noDataMessage": "No Protocols found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "Date", "yAxis": [ "counts" ], "group": "keyword", "createOtherGroup": 0, "showLegend": true, "xSettings": { "label": "Date" }, "ySettings": { "label": "Events" } } }, "conditionalVisibility": { "parameterName": "subpanel", "comparison": "isEqualTo", "value": "communications" }, "name": "query - 9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, Datasets: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutTopServicesByIP\r\n| where IP == \"{IndicatorValue}\"\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| mv-expand todynamic(Datasets)\r\n| parse-where tostring(Datasets) with * '\"label\":\"' label '\",\"tag_id\":' tag_id ',\"data\":' data ',\"css_color\":\"' css_color '\",\"dates\":' Dates '}'\r\n| project data, label, Dates, IP\r\n| mv-expand todynamic(data), todynamic(Dates)\r\n| extend Date = format_datetime( todatetime(Dates), \"yyyy-MM-dd\")\r\n| summarize counts = sum(todouble(data)) by Date, keyword = tostring(label)", "size": 0, "aggregation": 2, "showAnalytics": true, "title": "Top 10 Services for \"{IndicatorValue}\" and Its Peers", "noDataMessage": "No Services found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "Date", "yAxis": [ "counts" ], "group": "keyword", "showLegend": true, "xSettings": { "label": "Date" }, "ySettings": { "numberFormatSettings": { "unit": 1, "options": { "style": "decimal", "useGrouping": false } }, "min": 0, "max": 100, "label": "% of Traffic" } } }, "conditionalVisibility": { "parameterName": "subpanel", "comparison": "isEqualTo", "value": "services" }, "name": "query - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, Datasets: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutTopTagsByIP\r\n| where IP == \"{IndicatorValue}\"\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| mv-expand todynamic(Datasets)\r\n| parse-where tostring(Datasets) with * '\"label\":\"' label '\",\"tag_id\":' tag_id ',\"data\":' data ',\"css_color\":\"' css_color '\",\"dates\":' Dates '}'\r\n| project data, label, Dates, IP\r\n| mv-expand todynamic(data), todynamic(Dates)\r\n| extend Date = format_datetime( todatetime(Dates), \"yyyy-MM-dd\")\r\n| summarize counts = sum(todouble(data)) by Date, keyword = tostring(label)", "size": 0, "aggregation": 2, "showAnalytics": true, "title": "Top 10 Tags for \"{IndicatorValue}\" and Its Peers", "noDataMessage": "No Tags found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "Date", "yAxis": [ "counts" ], "group": "keyword", "showLegend": true, "xSettings": { "label": "Date" }, "ySettings": { "numberFormatSettings": { "unit": 1, "options": { "style": "decimal", "useGrouping": true } }, "min": 0, "max": 100, "label": "% of Traffic" } } }, "conditionalVisibility": { "parameterName": "subpanel", "comparison": "isEqualTo", "value": "tags" }, "name": "query - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, Datasets: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutTopAsnsByIP\r\n| where IP == \"{IndicatorValue}\"\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| mv-expand todynamic(Datasets)\r\n| parse-where tostring(Datasets) with * '\"label\":\"' label '\",\"tag_id\":' tag_id ',\"data\":' data ',\"css_color\":\"' css_color '\",\"dates\":' Dates '}'\r\n| project data, label, Dates, IP\r\n| mv-expand todynamic(data), todynamic(Dates)\r\n| extend Date = format_datetime( todatetime(Dates), \"yyyy-MM-dd\")\r\n| summarize counts = sum(todouble(data)) by Date, keyword = tostring(label)", "size": 0, "aggregation": 2, "showAnalytics": true, "title": "Top 10 ASNs for \"{IndicatorValue}\" and Its Peers", "noDataMessage": "No Asns found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "Date", "yAxis": [ "counts" ], "group": "keyword", "showLegend": true, "xSettings": { "label": "Date" }, "ySettings": { "numberFormatSettings": { "unit": 1, "options": { "style": "decimal", "useGrouping": true } }, "min": 0, "max": 100, "label": "% of Traffic" } } }, "conditionalVisibility": { "parameterName": "subpanel", "comparison": "isEqualTo", "value": "asns" }, "name": "query - 12" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, Datasets: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutTopCountryCodesByIP\r\n| where IP == \"{IndicatorValue}\"\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| mv-expand todynamic(Datasets)\r\n| parse-where tostring(Datasets) with * '\"label\":\"' label '\",\"tag_id\":' tag_id ',\"data\":' data ',\"country\":' Country ',\"css_color\":\"' css_color '\",\"dates\":' Dates '}'\r\n| project data, label, Dates, IP, Country\r\n| mv-expand todynamic(data), todynamic(Dates)\r\n| extend Date = format_datetime( todatetime(Dates), \"yyyy-MM-dd\")\r\n| summarize counts = sum(todouble(data)) by Date, keyword = tostring(Country)", "size": 0, "aggregation": 2, "showAnalytics": true, "title": "Top 10 Countries for \"{IndicatorValue}\" and Its Peers", "noDataMessage": "No Countries found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "Date", "yAxis": [ "counts" ], "group": "keyword", "createOtherGroup": 0, "showLegend": true, "xSettings": { "label": "Date" }, "ySettings": { "numberFormatSettings": { "unit": 1, "options": { "style": "decimal", "useGrouping": true } }, "min": 0, "max": 100, "label": "% of Traffic" } } }, "conditionalVisibility": { "parameterName": "subpanel", "comparison": "isEqualTo", "value": "countries" }, "name": "query - 13" } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "summary" }, "name": "group - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, Modified: string, Asn: real, Cidr: string, ['As Name']: string, ['Bgp Asn']: real, ['Bgp Asn Name']: string, ['Net Name']: string, CC: string, Description: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutWhois\r\n| where IP == '{IndicatorValue}'\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| project Modified = coalesce(Modified, \"-\"), ASN = Asn, CIDR = coalesce(Cidr, \"-\"), ['AS Name'] = coalesce(['As Name'], \"-\"), ['BGP ASN'] = ['Bgp Asn'], ['BGP AS Name'] = coalesce(['Bgp Asn Name'], \"-\"), ['Net Name'] = coalesce(['Net Name'], \"-\"), CC = coalesce(CC, \"-\"), Description = coalesce(Description, \"-\")", "size": 3, "showAnalytics": true, "title": "General", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 0", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, ['Admin Contact Id']: string, ['Admin Contact Role']: string, ['Admin Contact Email']: string, ['Admin Contact Phone']: string, ['Admin Contact Country']: string, ['Admin Contact Address']: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutWhois\r\n| where IP == '{IndicatorValue}'\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| project ['Admin Cotact ID'] = coalesce(['Admin Contact Id'], \"-\"),\r\n ['Admin Contact Role'] = coalesce(['Admin Contact Role'], \"-\"),\r\n ['Admin Contact Email'] = coalesce(['Admin Contact Email'], \"-\"),\r\n ['Admin Contact Phone'] = coalesce(['Admin Contact Phone'], \"-\"),\r\n ['Admin Contact Country'] = coalesce(['Admin Contact Country'], \"-\"),\r\n ['Admin Contact Address'] = coalesce(['Admin Contact Address'], \"-\")", "size": 3, "showAnalytics": true, "title": "Admin", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 1", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, ['Tech Contact Id']: string, ['Tech Contact Role']: string, ['Tech Contact Email']: string, ['Tech Contact Phone']: string, ['Tech Contact Country']: string, ['Tech Contact Address']: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutWhois\r\n| where IP == '{IndicatorValue}'\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| project ['Tech Contact ID'] = coalesce(['Tech Contact Id'], \"-\"),\r\n ['Tech Contact Role'] = coalesce(['Tech Contact Role'], \"-\"),\r\n ['Tech Contact Email'] = coalesce(['Tech Contact Email'], \"-\"),\r\n ['Tech Contact Phone'] = coalesce(['Tech Contact Phone'], \"-\"),\r\n ['Tech Contact Country'] = coalesce(['Tech Contact Country'], \"-\"),\r\n ['Tech Contact Address'] = coalesce(['Tech Contact Address'], \"-\")", "size": 3, "showAnalytics": true, "title": "Tech", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, ['Org Id']: string, ['Org Name']: string, ['Org Email']: string, ['Org Phone']: string, ['Org Country']: string, ['Org Address']: string, ['Mnt By Email']: string, ['Mnt Router Email']: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutWhois\r\n| where IP == '{IndicatorValue}'\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| project ['Organization ID'] = coalesce(['Org Id'], \"-\"),\r\n ['Organization Name'] = coalesce(['Org Name'], \"-\"),\r\n ['Organization Email'] = coalesce(['Org Email'], \"-\"),\r\n ['Organization Phone'] = coalesce(['Org Phone'], \"-\"),\r\n ['Organization Country'] = coalesce(['Org Country'], \"-\"),\r\n ['Organization Address'] = coalesce(['Org Address'], \"-\"),\r\n ['Maintained by Email'] = coalesce(['Mnt By Email'], \"-\"),\r\n ['Maintained by Router Email'] = coalesce(['Mnt Router Email'], \"-\")", "size": 3, "showAnalytics": true, "title": "Organization", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 3", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "whois" }, "name": "group - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CymruScoutCommunicationsData\r\n| where IP == \"{IndicatorValue}\"\r\n| extend [\"Client Ports\"] = strcat(toint([\"Peer Min Port\"]), \"-\", toint([\"Peer Max Port\"]), \"(\", toint([\"Peer Unique Ports\"]), \")\")\r\n| mv-expand\r\n todynamic([\"Peer Tags\"]),\r\n todynamic([\"Local Tags\"]),\r\n todynamic([\"Local Top Services\"]),\r\n todynamic([\"Peer As Info\"]),\r\n todynamic([\"Local As Info\"])\r\n| extend\r\n [\"Client Tags\"] = [\"Peer Tags\"][\"name\"],\r\n [\"Server Tags\"] = [\"Local Tags\"][\"name\"],\r\n [\"Server Ports\"] = [\"Local Top Services\"][\"port\"],\r\n [\"Client BGP AS Name\"] = split([\"Peer As Info\"][\"as_name\"], \", \"),\r\n [\"Server BGP AS Name\"] = split([\"Local As Info\"][\"as_name\"], \", \")\r\n| summarize\r\n [\"Client Tags\"] = make_list_if([\"Client Tags\"], isnotempty([\"Client Tags\"])),\r\n [\"Server Tags\"] = make_list_if([\"Server Tags\"], isnotempty([\"Server Tags\"])),\r\n [\"Server Ports\"] = make_list_if([\"Server Ports\"], isnotempty([\"Server Ports\"])),\r\n [\"Client BGP AS Name\"] = make_set_if([\"Client BGP AS Name\"], isnotempty([\"Client BGP AS Name\"][0])),\r\n [\"Server BGP AS Name\"] = make_set_if([\"Server BGP AS Name\"], isnotempty([\"Server BGP AS Name\"][0]))\r\n by\r\n [\"Proto Text\"],\r\n [\"Peer IP\"],\r\n [\"Peer Country Codes\"],\r\n [\"Client Ports\"],\r\n [\"Local Country Codes\"],\r\n [\"Event Count\"],\r\n [\"First Seen\"],\r\n [\"Last Seen\"],\r\n [\"Local IP\"]\r\n| extend\r\n [\"Client Tags\"] = strcat_array([\"Client Tags\"], \", \"),\r\n [\"Server Tags\"] = strcat_array([\"Server Tags\"], \", \"),\r\n [\"Client CC\"] = strcat_array(todynamic([\"Peer Country Codes\"]), \", \"),\r\n [\"Server Ports\"] = strcat_array([\"Server Ports\"], \", \"),\r\n [\"Server CC\"] = strcat_array(todynamic([\"Local Country Codes\"]), \", \"),\r\n [\"Client BGP AS Name\"] = strcat_array([\"Client BGP AS Name\"], \", \"),\r\n [\"Server BGP AS Name\"] = strcat_array([\"Server BGP AS Name\"], \", \") \r\n| project\r\n Proto = [\"Proto Text\"],\r\n [\"Client IP\"] = [\"Peer IP\"],\r\n [\"Client Tags\"],\r\n [\"Client CC\"],\r\n [\"Client Ports\"],\r\n [\"Server Ports\"],\r\n [\"Server IP\"] = [\"Local IP\"],\r\n [\"Server Tags\"],\r\n [\"Server CC\"],\r\n Count = [\"Event Count\"],\r\n [\"First Seen\"] = [\"First Seen\"],\r\n [\"Last Seen\"] = [\"Last Seen\"],\r\n [\"Client BGP AS Name\"],\r\n [\"Server BGP AS Name\"]", "size": 0, "showAnalytics": true, "title": "Communication Details for IP: {IndicatorValue}", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 0", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "communications" }, "name": "group - communication tab" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CymruScoutPdnsData\r\n| where IP == \"{IndicatorValue}\"\r\n| mv-expand todynamic([\"Name Servers\"])\r\n| extend names = [\"Name Servers\"][\"nameservers\"]\r\n| summarize [\"Name Server\"] = make_set(names)\r\n by\r\n Domain,\r\n Root,\r\n Type,\r\n [\"First Seen\"],\r\n [\"Last Seen\"],\r\n [\"Event Count\"],\r\n [\"Active Days\"],\r\n [\"Distinct IPs\"],\r\n [\"Domain Created\"],\r\n [\"Domain Expires\"],\r\n Registrar\r\n| extend\r\n [\"Name Server\"] = strcat_array([\"Name Server\"], \", \")\r\n| project\r\n Domain,\r\n Root,\r\n Type,\r\n [\"First Seen\"],\r\n [\"Last Seen\"],\r\n Count = [\"Event Count\"],\r\n Days = [\"Active Days\"],\r\n [\"Resolved IPs\"] = [\"Distinct IPs\"],\r\n [\"Domain Created\"],\r\n [\"Domain Expires\"],\r\n Registrar,\r\n [\"Name Server\"]", "size": 0, "showAnalytics": true, "title": "PDNS Details for IP: {IndicatorValue}", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 0", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "pdns" }, "name": "group - pdns tab" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CymruScoutX509Data\r\n| where IP == \"{IndicatorValue}\"\r\n| extend [\"Alt Names\"] = strcat_array(todynamic([\"Alt Names\"]), \", \")\r\n| project\r\n Port,\r\n [\"First Seen\"],\r\n [\"Last Seen\"],\r\n Subject,\r\n MD5,\r\n SHA1,\r\n SHA256,\r\n [\"Alt Names\"],\r\n [\"Not Before\"],\r\n [\"Not After\"],\r\n Validity = [\"Validity Period\"],\r\n Issuer", "size": 0, "showAnalytics": true, "title": "X.509 Details for IP: {IndicatorValue}", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 0", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "x509" }, "name": "group - x509 tab" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CymruScoutFingerprintsData\r\n| where IP == \"{IndicatorValue}\"\r\n| project\r\n Type = toupper(Type),\r\n Fingerprint,\r\n Port,\r\n [\"First Seen\"],\r\n [\"Last Seen\"],\r\n [\"Active Days\"],\r\n Count = [\"Event Count\"],\r\n [\"Distinct IPs\"]", "size": 0, "showAnalytics": true, "title": "Fingerprint Details for IP: {IndicatorValue}", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 0", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "fingerprints" }, "name": "group - fingerprints tab" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "74fd4c29-76cb-409a-9e30-059dda180f7c", "version": "KqlParameterItem/1.0", "name": "Service", "type": 2, "isRequired": true, "quote": "'", "delimiter": ",", "query": "CymruScoutOpenPortsData\r\n| where IP == \"{IndicatorValue}\" and\r\n isnotempty(Service)\r\n| extend Service = toupper(Service)\r\n| distinct Service\r\n| sort by Service asc ", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "da298faf-a83f-4b84-9094-3aed57497347", "version": "KqlParameterItem/1.0", "name": "Port", "type": 2, "isRequired": true, "quote": "'", "delimiter": ",", "query": "CymruScoutOpenPortsData\r\n| where IP == \"{IndicatorValue}\" and\r\n ('*' == ('{Service}') or toupper(Service) == ('{Service}')) and\r\n isnotempty(Port)\r\n| distinct Port\r\n| sort by Port asc ", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "9c5e6cdb-9a2c-422e-8c29-046e128e95b3", "version": "KqlParameterItem/1.0", "name": "Protocol", "type": 2, "isRequired": true, "quote": "'", "delimiter": ",", "query": "CymruScoutOpenPortsData\r\n| where IP == \"{IndicatorValue}\" and\r\n ('*' == ('{Service}') or toupper(Service) == ('{Service}')) and\r\n ('*' == ('{Port}') or Port == ('{Port}')) and\r\n isnotempty([\"Protocol Text\"])\r\n| distinct [\"Protocol Text\"]\r\n| sort by [\"Protocol Text\"] asc ", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 86400000 }, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CymruScoutOpenPortsData\r\n| where IP == \"{IndicatorValue}\" and\r\n ('*' == ('{Service}') or toupper(Service) == ('{Service}')) and\r\n ('*' == ('{Port}') or Port == ('{Port}')) and\r\n ('*' == ('{Protocol}') or [\"Protocol Text\"] == ('{Protocol}'))\r\n| project\r\n Port,\r\n [\"First Seen\"],\r\n [\"Last Seen\"],\r\n Count = [\"Event Count\"],\r\n Proto = [\"Protocol Text\"],\r\n Service,\r\n Banner,\r\n [\"Banner Length\"] = strlen(Banner),\r\n [\"Banner Hash\"] = [\"Banner SHA1\"]", "size": 0, "showAnalytics": true, "title": "Open Ports Details for IP: {IndicatorValue}", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 0", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "openports" }, "name": "group - open ports tab" } ] }, "conditionalVisibilities": [ { "parameterName": "IndicatorType", "comparison": "isEqualTo", "value": "IP" }, { "parameterName": "status", "comparison": "isEqualTo", "value": "Click here to populate data." } ], "name": "group - 5" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, Domain: string, ['As Info']: string, ['Country Codes']: string, ['Comms Total']: real) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutDomainData\r\n| where Domain == '{IndicatorValue}'\r\n| summarize arg_max(TimeGenerated, *) by Domain, IP\r\n| mv-expand todynamic(['As Info'])\r\n| extend CountryCode = todynamic(['Country Codes'])\r\n| project IP, ['Country Codes']=CountryCode[0], ['AS Name']=['As Info'].as_name, ['Events Communication']=['Comms Total']\r\n| sort by tostring(IP) asc", "size": 0, "showAnalytics": true, "title": "Domain Details for: \"{IndicatorValue}\"", "noDataMessage": "No Domain Details found", "timeContext": { "durationMs": 86400000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 0", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibilities": [ { "parameterName": "IndicatorType", "comparison": "isEqualTo", "value": "Domain" }, { "parameterName": "status", "comparison": "isEqualTo", "value": "Click here to populate data." } ], "name": "group - 4" }, { "type": 1, "content": { "json": "📝***Refresh the web page to fetch details of recently collected events***" }, "name": "text - 7" } ] }, "conditionalVisibility": { "parameterName": "dashboard", "comparison": "isEqualTo", "value": "LiveInvestigation" }, "name": "group - 0" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "## Account Usage\r\n---" }, "name": "text - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table=datatable(['Query Limit']: real, ['Used Queries']: real, ['Remaining Queries']: real, ['Used Queries (%)']: real, ['Foundation Query Limit']: real, ['Used Foundation Queries']: real, ['Remaining Foundation Queries']: real, ['Used Foundation Queries (%)']: real)[];\r\nunion isfuzzy=true\r\ndummy_table,\r\nCymruScoutAccountUsage\r\n| project ['Query Limit'], ['Used Queries'], ['Remaining Queries'], ['Used Queries (%)'], ['Foundation Query Limit'], ['Used Foundation Queries'], ['Remaining Foundation Queries'], ['Used Foundation Queries (%)']", "size": 3, "showAnalytics": true, "title": "Account Usage Details", "noDataMessage": "No data found.", "timeContext": { "durationMs": 2592000000 }, "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Used Queries (%)", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "-1", "representation": "gray", "text": "{0}{1}" }, { "operator": "<", "thresholdValue": "50", "representation": "green", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "90", "representation": "redBright", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "orange", "text": "{0}{1}" } ] } }, { "columnMatch": "Used Foundation Queries (%)", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "==", "thresholdValue": "-1", "representation": "gray", "text": "{0}{1}" }, { "operator": "<", "thresholdValue": "50", "representation": "green", "text": "{0}{1}" }, { "operator": ">=", "thresholdValue": "90", "representation": "redBright", "text": "{0}{1}" }, { "operator": "Default", "thresholdValue": null, "representation": "orange", "text": "{0}{1}" } ] } } ], "rowLimit": 10000 } }, "name": "query - 0", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "📝***Refresh the web page to fetch details of recently collected events***" }, "name": "text - 2" } ] }, "conditionalVisibility": { "parameterName": "dashboard", "comparison": "isEqualTo", "value": "AccountUsage" }, "name": "group - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 1, "content": { "json": "This tab depends on the **ASIM Parsers** and **ThreatIntelligenceIndicators**.
\r\nPlease configure ASIM Parsers in the workspace and create/upload some indicators in ThreatIntelligence to visualize data in this tab.\r\n", "style": "info" }, "name": "text - 10" }, { "type": 1, "content": { "json": "## Correlation Overview\r\n---" }, "name": "text - 1" }, { "type": 1, "content": { "json": "## Steps to perform Correlation using this workbook\r\n- This workbook is intended to help perform Correlation of Indicators (**Indicator Type:** IP or Domain).\r\n- Select **Time Range** for which you want to perform correlation of other sources data with Team Cymru Scout data.\r\n- Select **Indicator Type** from Indicator Type filter. Default All is selected.\r\n- Select **Search Matching Algorithm** based on which you want to perform correlation of other sources data with Team Cymru Scout Data.\r\n\t- **ThreatIntelligenceIndicator**: Threat indicators are data that associate observed artifacts such as URLs, file hashes, or IP addresses with known threat activity such as phishing, botnets, or malware. \r\n\t- **ASIM Parsers**: The Advanced Security Information Model (ASIM) provides a seamless experience for handling various sources in uniform, normalized views. ASIM allows for predictable entities correlation across normalized tables\r\n- If you select **ASIM Parsers** in \"Search Matching Algorithm\", filter for ASIM Parsers will be visible.\r\n\t- Select ASIM Parsers schema from **ASIM Parsers** filter. Default All is selected.\r\n- Based on selected filters, correlated data will be visible in below panles.\r\n
\r\n
\r\n**Note** :
\r\n\t* If data is not populated, \r\n\t\t- Check ASIM Parsers schema is available in workspace and does not have any error. \r\n\t\t- Check ThreatIntelligenceIndicator table has indicators available from other sources.", "style": "upsell" }, "name": "text - 9" }, { "type": 1, "content": { "json": "## Steps to configure ASIM Parsers in workspace\r\n- Go to **[ASIM](https://github.com/Azure/Azure-Sentinel/tree/master/ASIM)** folder in Azure-Sentinel Repository.\r\n- Select Schema you want to add from list of available schema in README.md. e.g. *NetworkSession*\r\n- Click on the **Deploy to Azure** button besides NetworkSession Schema.\r\n- You will be redirected to the custom deployment page where you need to provide information for **Resource group**, **Region**, **Workspace name** and **Workspace Region**.\r\n- Click on the **Review+Create** button. \r\n- Review the next dialog from Azure, and then click on **Create** to install the ASIM parser.\r\n- Follow the same steps to deploy the ASIM Parsers for below schemas:\r\n\t- *WebSession*\r\n\t- *DNS*\r\n\t- *DHCP*\r\n\t- *Audit*\r\n\t- *Authentication*\r\n
", "style": "upsell" }, "name": "text - 11" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "7901b4ce-ad76-418d-8ff2-4d79a07f08d7", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 86400000 } }, { "id": "8d03e2ce-4f87-4475-ab03-7ec851147151", "version": "KqlParameterItem/1.0", "name": "TypeIndicator", "label": "Indicator Type", "type": 2, "isRequired": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "jsonData": "[\"IP\",\r\n\"Domain\"]", "timeContext": { "durationMs": 86400000 }, "defaultValue": "value::all" }, { "id": "cf53799f-d9a6-41ab-94d3-06118f237555", "version": "KqlParameterItem/1.0", "name": "SearchMatchingAlgorithm", "label": "Search Matching Algorithm", "type": 2, "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n \"ASIM Parsers\",\r\n \"ThreatIntelligenceIndicator\"\r\n]", "timeContext": { "durationMs": 86400000 }, "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "9f6f860e-9eca-4af4-a638-2cf912745e3f", "version": "KqlParameterItem/1.0", "name": "ASIMParsers", "label": "ASIM Parsers", "type": 2, "isRequired": true, "multiSelect": true, "quote": "'", "delimiter": ",", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "jsonData": "[\r\n \"NetworkSession\",\r\n \"WebSession\",\r\n \"DNS\",\r\n \"DHCP\",\r\n \"Authentication\",\r\n \"Audit\"\r\n]", "timeContext": { "durationMs": 86400000 }, "value": [ "value::all" ] } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "conditionalVisibility": { "parameterName": "SearchMatchingAlgorithm", "comparison": "isEqualTo", "value": "ASIM Parsers" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let asimdata = iff('{SearchMatchingAlgorithm}' == \"ASIM Parsers\", dynamic([{ASIMParsers}]), dynamic([]));\r\nlet dummy_table = datatable(Indicator: string)[];\r\nunion isfuzzy=true\r\ndummy_table,\r\nCymruScoutCorrelate(indicatorType='{TypeIndicator}',\r\n searchAlgo='{SearchMatchingAlgorithm}',\r\n asimParsers=asimdata)\r\n | summarize Count = dcount(Indicator)", "size": 1, "showAnalytics": true, "title": "Total Matched Indicators", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "Count", "exportParameterName": "Count", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": {}, "rightContent": { "columnMatch": "Count", "formatter": 12, "formatOptions": { "palette": "greenRed" }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, "showBorder": true, "size": "auto" } }, "customWidth": "50", "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let asimdata = iff('{SearchMatchingAlgorithm}' == \"ASIM Parsers\", dynamic([{ASIMParsers}]), dynamic([]));\r\nlet dummy_table = datatable(Indicator: string, IndicatorType: string)[];\r\nunion isfuzzy=true\r\ndummy_table,\r\nCymruScoutCorrelate(indicatorType='{TypeIndicator}',\r\n searchAlgo='{SearchMatchingAlgorithm}',\r\n asimParsers=asimdata)\r\n| summarize Count=dcount(Indicator) by IndicatorType", "size": 1, "showAnalytics": true, "title": "Matched Indicators by Type", "noDataMessage": "No data found.", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "series", "exportParameterName": "Type", "exportDefaultValue": "none", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "piechart" }, "customWidth": "50", "name": "query - 3", "styleSettings": { "maxWidth": "50%" } }, { "type": 1, "content": { "json": "#### Click on the count in panel **Total Matched Indicators** above to view more information.", "style": "info" }, "customWidth": "50", "name": "text - 13" }, { "type": 1, "content": { "json": "#### Click on the section in panel **Matched Indicators by Type** above to view more information.", "style": "info" }, "customWidth": "50", "name": "text - 14" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let asimdata = iff('{SearchMatchingAlgorithm}' == \"ASIM Parsers\", dynamic([{ASIMParsers}]), dynamic([]));\r\nlet dummy_table = datatable(Indicator: string, TimeGenerated: datetime, IndicatorType: string, EventVendor: string, EventProduct: string, EventSchema: string)[];\r\nunion isfuzzy=true\r\ndummy_table,\r\nCymruScoutCorrelate(indicatorType='{TypeIndicator}',\r\n searchAlgo='{SearchMatchingAlgorithm}',\r\n asimParsers=asimdata)\r\n| extend Source = iff('{SearchMatchingAlgorithm}' == \"ASIM Parsers\", EventSchema, \"ThreatIntelligenceIndicator\")\r\n| summarize arg_max(TimeGenerated, *) by Indicator\r\n| project Indicator, TimeGenerated, IndicatorType, Source", "size": 3, "showAnalytics": true, "title": "Details for Total Matched Indicators", "noDataMessage": "No data found.", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "Count", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 5", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let asimdata = iff('{SearchMatchingAlgorithm}' == \"ASIM Parsers\", dynamic([{ASIMParsers}]), dynamic([]));\r\nlet dummy_table = datatable(Indicator: string, IndicatorType: string, TimeGenerated: datetime, EventSchema: string)[];\r\nunion isfuzzy=true\r\ndummy_table,\r\nCymruScoutCorrelate(indicatorType='{TypeIndicator}',\r\n searchAlgo='{SearchMatchingAlgorithm}',\r\n asimParsers=asimdata)\r\n| extend IndicatorType = tostring(IndicatorType)\r\n| where IndicatorType == '{Type}'\r\n| extend Source = iff('{SearchMatchingAlgorithm}' == \"ASIM Parsers\", EventSchema, \"ThreatIntelligenceIndicator\")\r\n| summarize arg_max(TimeGenerated, *) by Indicator\r\n| project Indicator, TimeGenerated, IndicatorType, Source", "size": 3, "showAnalytics": true, "title": "Details for Matched Indicators by Type", "noDataMessage": "No data found.", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "filter": true } }, "conditionalVisibility": { "parameterName": "Type", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 6", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let asimdata = iff('{SearchMatchingAlgorithm}' == \"ASIM Parsers\", dynamic([{ASIMParsers}]), dynamic([]));\r\nlet dummy_table = datatable(Indicator: string, IndicatorType: string, TimeGenerated: datetime, EventSchema: string)[];\r\nlet correlateddata = union isfuzzy=true\r\ndummy_table,\r\nCymruScoutCorrelate(indicatorType='{TypeIndicator}',\r\n searchAlgo='{SearchMatchingAlgorithm}',\r\n asimParsers=asimdata);\r\nlet indicatorcount = correlateddata\r\n | summarize Count=count() by Indicator;\r\ncorrelateddata\r\n| extend Source = iff('{SearchMatchingAlgorithm}' == \"ASIM Parsers\", EventSchema, \"ThreatIntelligenceIndicator\")\r\n| summarize arg_max(TimeGenerated, *) by Indicator\r\n| join kind=inner(indicatorcount) on Indicator\r\n| project Indicator, IndicatorType, Source, TimeGenerated, Count", "size": 3, "showAnalytics": true, "title": "Matched Indicators Details", "noDataMessage": "No data found.", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "exportFieldName": "Indicator", "exportParameterName": "Indicator", "exportDefaultValue": "none", "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "#### Click on the cell in grid panel **Matched Indicators Details** above to view more information related to Indicator from Other Source.", "style": "info" }, "name": "text - 15" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let asimdata = iff('{SearchMatchingAlgorithm}' == \"ASIM Parsers\", dynamic([{ASIMParsers}]), dynamic([]));\r\nlet dummy_table = datatable(Indicator: string, IndicatorType: string, TimeGenerated: datetime, EventSchema: string)[];\r\nunion isfuzzy=true\r\ndummy_table,\r\nCymruScoutCorrelate(indicatorType='{TypeIndicator}',\r\n searchAlgo='{SearchMatchingAlgorithm}',\r\n asimParsers=asimdata)\r\n| where Indicator == '{Indicator}'\r\n| extend Source = iff('{SearchMatchingAlgorithm}' == \"ASIM Parsers\", EventSchema, \"ThreatIntelligenceIndicator\")\r\n| project-reorder Indicator, IndicatorType, TimeGenerated, Source", "size": 3, "showAnalytics": true, "title": "Matched Indicator Details from Other Source", "noDataMessage": "No data found.", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "conditionalVisibility": { "parameterName": "Indicator", "comparison": "isNotEqualTo", "value": "none" }, "name": "query - 7", "styleSettings": { "showBorder": true } }, { "type": 1, "content": { "json": "📝***Refresh the web page to fetch details of recently collected events***" }, "name": "text - 12" } ] }, "conditionalVisibility": { "parameterName": "dashboard", "comparison": "isEqualTo", "value": "CorrelationOverview" }, "name": "group - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "4ac7ec28-3b21-418e-acca-b49eb1b977b5", "version": "KqlParameterItem/1.0", "name": "TimeRange", "label": "Time Range", "type": 4, "description": "Select the Time Range for query below panels and filters", "isRequired": true, "typeSettings": { "selectableValues": [ { "durationMs": 300000 }, { "durationMs": 900000 }, { "durationMs": 1800000 }, { "durationMs": 3600000 }, { "durationMs": 14400000 }, { "durationMs": 43200000 }, { "durationMs": 86400000 }, { "durationMs": 172800000 }, { "durationMs": 259200000 }, { "durationMs": 604800000 }, { "durationMs": 1209600000 }, { "durationMs": 2419200000 }, { "durationMs": 2592000000 }, { "durationMs": 5184000000 }, { "durationMs": 7776000000 } ], "allowCustom": true }, "timeContext": { "durationMs": 86400000 }, "value": { "durationMs": 86400000 } }, { "id": "f8b60e10-7e20-4c46-a2d1-5064d830a056", "version": "KqlParameterItem/1.0", "name": "IndicatorType", "label": "Indicator Type", "type": 2, "isRequired": true, "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "jsonData": "[\r\n{\"value\": \"IP\"},\r\n{\"value\": \"Domain\"}\r\n]", "timeContext": { "durationMs": 86400000 }, "value": null }, { "id": "6188b837-a313-4688-8ced-d786e6c2484c", "version": "KqlParameterItem/1.0", "name": "IndicatorValue", "label": "Indicator Value", "type": 2, "isRequired": true, "query": "Live_Investigation_{IndicatorType}_Indicators_CL\r\n| where isnotempty(value_s)\r\n| distinct value_s\r\n| sort by value_s asc", "typeSettings": { "additionalResourceOptions": [], "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": null } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 0" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Domain Details For: \"{IndicatorValue}\"", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, Domain: string, ['As Info']: string, ['Country Codes']: string, ['Comms Total']: real) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutDomainData\r\n| where Domain == ('{IndicatorValue}')\r\n| summarize arg_max(TimeGenerated, *) by Domain, IP\r\n| mv-expand todynamic(['As Info'])\r\n| extend CountryCode = todynamic(['Country Codes'])\r\n| project IP, ['Country Codes']=CountryCode[0], ['AS Name']=['As Info'].as_name, ['Events Communication']=['Comms Total']\r\n| sort by tostring(IP) asc", "size": 0, "showAnalytics": true, "noDataMessage": "No Domain Details found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 0", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibilities": [ { "parameterName": "IndicatorValue", "comparison": "isNotEqualTo" }, { "parameterName": "IndicatorType", "comparison": "isNotEqualTo", "value": "IP" } ], "name": "group - investigated domain" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "IP Details For: \"{IndicatorValue}\"", "items": [ { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "a5a1e7fd-8177-4055-93e0-5a2ada1e60c9", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Summary", "subTarget": "summary", "style": "link" }, { "id": "125ea9d0-d286-4248-a1e5-02add32ccd58", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Communications", "subTarget": "communications", "style": "link" }, { "id": "851a074d-9cfd-427a-9e50-6efca9a8d3da", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Open Ports", "subTarget": "openports", "style": "link" }, { "id": "26d316a2-f3d2-4c8b-872f-a582df1423db", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "PDNS", "subTarget": "pdns", "style": "link" }, { "id": "8fd0697e-4c61-46ac-a0e0-c0a6e29bdb46", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "X.509", "subTarget": "x509", "style": "link" }, { "id": "39bbecc4-df58-4663-8c42-7bdc8903d9ba", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Fingerprints", "subTarget": "fingerprints", "style": "link" }, { "id": "bb617578-5e0c-454b-a9b6-7ce772b69dc2", "cellValue": "tab", "linkTarget": "parameter", "linkLabel": "Whois", "subTarget": "whois", "style": "link" } ] }, "name": "links - 3" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "title": "Identity Details", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, ['Overall Rating']: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutSummary\r\n| where IP == ('{IndicatorValue}')\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| extend Overall_Rating = case(\r\n tolower(['Overall Rating']) == \"suspicious\", \"⚠ Suspicious\",\r\n tolower(['Overall Rating']) == \"malicious\", \"ⓘ Malicious\",\r\n \"No Rating\")\r\n| project ['Overall Rating'] = Overall_Rating", "size": 3, "title": "Overall Rating", "noDataMessage": "No Overall rating found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Overall Rating", "formatter": 18, "formatOptions": { "thresholdsOptions": "colors", "thresholdsGrid": [ { "operator": "contains", "thresholdValue": "Suspicious", "representation": "orange", "text": "{0}{1}" }, { "operator": "contains", "thresholdValue": "Malicious", "representation": "redBright", "text": "{0}{1}" }, { "operator": "Default", "text": "{0}{1}" } ] }, "numberFormat": { "unit": 0, "options": { "style": "decimal" } } }, "showBorder": false, "sortOrderField": 1, "size": "auto" } }, "customWidth": "50", "name": "query - 0", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, ['Geo IP CC']:string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutSummary\r\n| where IP == ('{IndicatorValue}')\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| extend Country = iif(isempty(['Geo IP CC']), \"NA\", ['Geo IP CC'])", "size": 3, "title": "Country", "noDataMessage": "No Associated Country found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "tiles", "tileSettings": { "titleContent": { "columnMatch": "Country", "formatter": 12, "formatOptions": { "palette": "none" } }, "showBorder": false, "size": "auto" } }, "customWidth": "50", "name": "query - 1", "styleSettings": { "margin": "1px", "padding": "3px", "showBorder": true } } ] }, "name": "group - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, ['Org Name']: string, [\"Net Name\"]: string, ['As Name']: string, Asn: real) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutIdentity\r\n| where IP == ('{IndicatorValue}')\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| project [\"Organization Name\"]=['Org Name'], [\"Net Name\"], [\"AS Name\"] = ['As Name'], [\"ASN\"]=Asn", "size": 0, "showAnalytics": true, "title": "Organization Details", "noDataMessage": "No Organization data found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "customWidth": "50", "name": "query - 1", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, Insights:string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutSummary\r\n| where IP == ('{IndicatorValue}')\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| mv-expand todynamic(Insights)\r\n| project ['Insights']=Insights.message", "size": 0, "showAnalytics": true, "title": "Insights Information", "noDataMessage": "No Insights found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Insights", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "100%" } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "50", "name": "query - 5", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string) [];\r\nlet dummy_table2 = datatable(TimeGenerated: datetime, IP: string, Port: real, Service: string, Protocol: real, ['Protocol Name']: string, ['First Seen']: string, ['Last Seen']: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutSummary\r\n| where IP == ('{IndicatorValue}')\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| join kind=inner (union isfuzzy=true dummy_table2, CymruScoutSummaryTopOpenPorts | summarize arg_max(TimeGenerated, *) by IP, Port, Protocol) on $left.IP == $right.IP\r\n| project ['Protocol']=['Protocol Name'], Port, Service, ['First Seen']=format_datetime(todatetime(['First Seen']), \"yyyy-MM-dd\"), ['Last Seen']=format_datetime(todatetime(['Last Seen']), \"yyyy-MM-dd\")\r\n| sort by ['Last Seen'] desc", "size": 0, "showAnalytics": true, "title": "Open Ports", "noDataMessage": "No Open Ports found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Service", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "10%" } }, { "columnMatch": "First Seen", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15%" } }, { "columnMatch": "Last Seen", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "15%" } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "50", "name": "query - 6", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string) [];\r\nlet dummy_table2 = datatable(TimeGenerated: datetime, IP: string, Domain: string, ['Event Count']: real) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutSummary\r\n| where IP == ('{IndicatorValue}')\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| join kind=inner (union isfuzzy=true dummy_table2, CymruScoutSummaryTopPdns | summarize arg_max(TimeGenerated, *) by IP, Domain) on $left.IP == $right.IP\r\n| project Domain, ['Event Count']\r\n| sort by toint(['Event Count']) desc", "size": 0, "showAnalytics": true, "title": "Most Observed Domains", "noDataMessage": "No Domain found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Domain", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "80%" } }, { "columnMatch": "Event Count", "formatter": 4, "formatOptions": { "palette": "greenRed" } } ], "rowLimit": 10000, "filter": true } }, "customWidth": "50", "name": "query - 4", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, Port: real, MD5: string, Subject: string, Issuer: string, ['Valid Days']: real, [\"Not Before\"]: string, [\"Not After\"]: string, SHA1: string, SHA256: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutSummaryTopCerts\r\n| where IP == ('{IndicatorValue}')\r\n| summarize arg_max(TimeGenerated,*), Ports = make_set_if(toint(Port), isnotempty(Port)) by Issuer, Subject, ['Not After'], ['Not Before'], MD5, ['Valid Days'], SHA1, SHA256\r\n| extend Ports = strcat_array(Ports, \", \")\r\n| project\r\n Subject,\r\n Issuer,\r\n Ports,\r\n [\"Validity Period\"] = ['Valid Days'],\r\n [\"Not Before\"],\r\n [\"Not After\"],\r\n MD5,\r\n SHA1,\r\n SHA256", "size": 0, "showAnalytics": true, "title": "Certificate Details", "noDataMessage": "No Certificate Details found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 5", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, ['Signature G']: string, ['Signature S']: string, ['Signature Type']: string, ['First Seen']: string, ['Last Seen']: string, Port: real) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutSummaryTopFingerprints\r\n| where IP == ('{IndicatorValue}')\r\n| extend Signature = coalesce(['Signature G'], ['Signature S'])\r\n| summarize arg_max(TimeGenerated, *) by IP, Signature, Port\r\n| project\r\n Type = ['Signature Type'],\r\n Signature,\r\n ['First Seen'] = format_datetime(todatetime(['First Seen']), \"yyyy-MM-dd\"),\r\n ['Last Seen'] = format_datetime(todatetime(['Last Seen']), \"yyyy-MM-dd\"),\r\n Port\r\n| sort by ['Last Seen'] desc", "size": 0, "showAnalytics": true, "title": "Most Observed Fingerprints", "noDataMessage": "No Fingerprints found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "formatters": [ { "columnMatch": "Signature", "formatter": 0, "formatOptions": { "customColumnWidthSetting": "50%" } } ], "rowLimit": 10000, "filter": true } }, "name": "query - 6", "styleSettings": { "showBorder": true } }, { "type": 11, "content": { "version": "LinkItem/1.0", "style": "tabs", "links": [ { "id": "70b2d043-ae23-41b3-bee1-1e6c55239d88", "cellValue": "subpanel", "linkTarget": "parameter", "linkLabel": "Overview", "subTarget": "overview", "style": "link" }, { "id": "1e014924-becc-4000-9f76-283dc725d77e", "cellValue": "subpanel", "linkTarget": "parameter", "linkLabel": "Communications", "subTarget": "communications", "style": "link" }, { "id": "8e8df187-daca-4dbc-843b-d504d58a0633", "cellValue": "subpanel", "linkTarget": "parameter", "linkLabel": "Services", "subTarget": "services", "style": "link" }, { "id": "394bd6fd-0d88-4bf9-a013-74451d9ca265", "cellValue": "subpanel", "linkTarget": "parameter", "linkLabel": "Tags", "subTarget": "tags", "style": "link" }, { "id": "db35d66c-f096-4792-8f11-9a3104deacf2", "cellValue": "subpanel", "linkTarget": "parameter", "linkLabel": "ASNs", "subTarget": "asns", "style": "link" }, { "id": "9a6a2a5f-c505-4941-abb8-4bf74afcfdf3", "cellValue": "subpanel", "linkTarget": "parameter", "linkLabel": "Countries", "subTarget": "countries", "style": "link" } ] }, "name": "links - 7" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string) [];\r\nlet dummy_table2 = datatable(TimeGenerated: datetime, IP: string, Domain: string, Service: string, ['First Seen']: string, ['Last Seen']: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutSummary\r\n| where IP == ('{IndicatorValue}')\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| join kind=inner (union isfuzzy=true dummy_table2, CymruScoutSummaryTopPdns| summarize arg_max(TimeGenerated, *) by IP, Domain) on $left.IP == $right.IP\r\n| project Domain, ['First Seen']=format_datetime(todatetime(['First Seen']), \"yyyy-MM-dd\"), ['Last Seen']=format_datetime(todatetime(['Last Seen']), \"yyyy-MM-dd\")\r\n| extend Duration = range(todatetime(['First Seen']), todatetime(['Last Seen']), 1d) \r\n| mv-expand Duration \r\n| project Domain, Timestamp = Duration \r\n| summarize count() by tostring(Domain), bin(todatetime(Timestamp), 1d)", "size": 0, "aggregation": 2, "showAnalytics": true, "title": "PDNS", "noDataMessage": "No PDNS found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "xAxis": "Timestamp", "showLegend": true, "xSettings": { "label": "Date" } } }, "name": "query - 0" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, ['Tag Timeline Data']: string, ['First Seen']: string, ['Last Seen']: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutSummary\r\n| where IP == ('{IndicatorValue}')\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| mv-expand todynamic(['Tag Timeline Data'])\r\n| extend Tags = ['Tag Timeline Data'].tag.name\r\n| project Tags, ['First Seen']=format_datetime(todatetime(['Tag Timeline Data'].first_seen), \"yyyy-MM-dd\"), ['Last Seen']=format_datetime(todatetime(['Tag Timeline Data'].last_seen), \"yyyy-MM-dd\")\r\n| extend Duration = range(todatetime(['First Seen']), todatetime(['Last Seen']), 1d) \r\n| mv-expand Duration \r\n| project Tags, Timestamp = Duration \r\n| summarize count() by tostring(Tags), bin(todatetime(Timestamp), 1d)", "size": 0, "aggregation": 2, "showAnalytics": true, "title": "Tags", "noDataMessage": "No Tags found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "xAxis": "Timestamp", "showLegend": true } }, "name": "query - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string) [];\r\nlet dummy_table2 = datatable(TimeGenerated: datetime, IP: string, Port: real, Protocol: real, ['First Seen']: string, ['Last Seen']: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutSummary\r\n| where IP == ('{IndicatorValue}')\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| join kind=inner (union isfuzzy=true dummy_table2, CymruScoutSummaryTopOpenPorts| summarize arg_max(TimeGenerated, *) by IP, Port, Protocol) on $left.IP == $right.IP\r\n| project Port, ['First Seen']=format_datetime(todatetime(['First Seen']), \"yyyy-MM-dd\"), ['Last Seen']=format_datetime(todatetime(['Last Seen']), \"yyyy-MM-dd\")\r\n| extend Duration = range(todatetime(['First Seen']), todatetime(['Last Seen']), 1d) \r\n| mv-expand Duration \r\n| project Port, Timestamp = Duration \r\n| summarize Count = count() by tostring(toint(Port)), bin(todatetime(Timestamp), 1d)", "size": 0, "aggregation": 2, "showAnalytics": true, "title": "Open Ports", "noDataMessage": "No Open Ports found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "xAxis": "Timestamp", "yAxis": [ "Count" ], "group": "Port", "createOtherGroup": 0, "showLegend": true, "xSettings": { "label": "Date" }, "ySettings": { "label": "No. Of Ports" } } }, "name": "query - 2" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, MD5: string, Port: real, Subject: string, Issuer: string, ['First Seen']: string, ['Last Seen']: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutSummaryTopCerts\r\n| where IP == ('{IndicatorValue}')\r\n| summarize arg_max(TimeGenerated, *) by IP, Port, MD5\r\n| extend Subject = strcat(Subject, Issuer, \"=\", Port)\r\n| project Subject, ['First Seen']=format_datetime(todatetime(['First Seen']), \"yyyy-MM-dd\"), ['Last Seen']=format_datetime(todatetime(['Last Seen']), \"yyyy-MM-dd\")\r\n| extend Duration = range(todatetime(['First Seen']), todatetime(['Last Seen']), 1d) \r\n| mv-expand Duration \r\n| project Subject, Timestamp = Duration\r\n| summarize Count = count() by Subject, bin(todatetime(Timestamp), 1d)\r\n| top 100 by Timestamp", "size": 0, "aggregation": 2, "showAnalytics": true, "title": "Certificate", "noDataMessage": "No Certificate found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "timechart", "chartSettings": { "xAxis": "Timestamp", "yAxis": [ "Count" ], "group": "Subject", "createOtherGroup": 0, "showLegend": true } }, "name": "query - 3" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, ['Proto By Date']: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutProtoByIP\r\n| where IP == ('{IndicatorValue}')\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| mv-expand todynamic(['Proto By Date'])\r\n| mv-expand todynamic(['Proto By Date'].data)\r\n| parse-where ['Proto By Date_data'] with * '\"count\":' Count ',\"date\":\"' dates '\"}'\r\n| extend Date = format_datetime( todatetime(dates), \"yyyy-MM-dd\")\r\n| summarize counts = sum(tolong(Count)) by Date", "size": 0, "aggregation": 2, "showAnalytics": true, "title": "Events", "noDataMessage": "No Events Found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "tileSettings": { "showBorder": false, "titleContent": { "columnMatch": "Date", "formatter": 1 }, "leftContent": { "columnMatch": "counts", "formatter": 12, "formatOptions": { "palette": "auto" }, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "graphSettings": { "type": 0, "topContent": { "columnMatch": "Date", "formatter": 1 }, "centerContent": { "columnMatch": "counts", "formatter": 1, "numberFormat": { "unit": 17, "options": { "maximumSignificantDigits": 3, "maximumFractionDigits": 2 } } } }, "chartSettings": { "xAxis": "Date", "yAxis": [ "counts" ], "createOtherGroup": 0, "xSettings": { "label": "Date" }, "ySettings": { "label": "No. of Events" } }, "mapSettings": { "locInfo": "LatLong", "sizeSettings": "counts", "sizeAggregation": "Sum", "legendMetric": "counts", "legendAggregation": "Sum", "itemColorSettings": { "type": "heatmap", "colorAggregation": "Sum", "nodeColorField": "counts", "heatmapPalette": "greenRed" } } }, "name": "query - 4" } ] }, "conditionalVisibility": { "parameterName": "subpanel", "comparison": "isEqualTo", "value": "overview" }, "name": "group - 8" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, ['Proto By Date']: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutProtoByIP\r\n| where IP == ('{IndicatorValue}')\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| mv-expand todynamic(['Proto By Date'])\r\n| mv-expand todynamic(['Proto By Date'].data)\r\n| parse-where ['Proto By Date_data'] with * '\"count\":' Count ',\"date\":\"' dates '\"}'\r\n| extend Date = format_datetime( todatetime(dates), \"yyyy-MM-dd\")\r\n| summarize counts = sum(tolong(Count)) by Date, keyword = tostring(['Proto By Date'].keyword)", "size": 0, "aggregation": 2, "showAnalytics": true, "title": "Protocols and Its Peers", "noDataMessage": "No Protocols found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "Date", "yAxis": [ "counts" ], "group": "keyword", "createOtherGroup": 0, "showLegend": true, "xSettings": { "label": "Date" }, "ySettings": { "label": "Events" } } }, "conditionalVisibility": { "parameterName": "subpanel", "comparison": "isEqualTo", "value": "communications" }, "name": "query - 9" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, Datasets: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutTopServicesByIP\r\n| where IP == ('{IndicatorValue}')\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| mv-expand todynamic(Datasets)\r\n| parse-where tostring(Datasets) with * '\"label\":\"' label '\",\"tag_id\":' tag_id ',\"data\":' data ',\"css_color\":\"' css_color '\",\"dates\":' Dates '}'\r\n| project data, label, Dates, IP\r\n| mv-expand todynamic(data), todynamic(Dates)\r\n| extend Date = format_datetime( todatetime(Dates), \"yyyy-MM-dd\")\r\n| summarize counts = sum(todouble(data)) by Date, keyword = tostring(label)", "size": 0, "aggregation": 2, "showAnalytics": true, "title": "Top 10 Services and Its Peers", "noDataMessage": "No Services found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "Date", "yAxis": [ "counts" ], "group": "keyword", "showLegend": true, "xSettings": { "label": "Date" }, "ySettings": { "numberFormatSettings": { "unit": 1, "options": { "style": "decimal", "useGrouping": false } }, "min": 0, "max": 100, "label": "% of Traffic" } } }, "conditionalVisibility": { "parameterName": "subpanel", "comparison": "isEqualTo", "value": "services" }, "name": "query - 10" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, Datasets: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutTopTagsByIP\r\n| where IP == ('{IndicatorValue}')\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| mv-expand todynamic(Datasets)\r\n| parse-where tostring(Datasets) with * '\"label\":\"' label '\",\"tag_id\":' tag_id ',\"data\":' data ',\"css_color\":\"' css_color '\",\"dates\":' Dates '}'\r\n| project data, label, Dates, IP\r\n| mv-expand todynamic(data), todynamic(Dates)\r\n| extend Date = format_datetime( todatetime(Dates), \"yyyy-MM-dd\")\r\n| summarize counts = sum(todouble(data)) by Date, keyword = tostring(label)", "size": 0, "aggregation": 2, "showAnalytics": true, "title": "Top 10 Tags and Its Peers", "noDataMessage": "No Tags found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "Date", "yAxis": [ "counts" ], "group": "keyword", "showLegend": true, "xSettings": { "label": "Date" }, "ySettings": { "numberFormatSettings": { "unit": 1, "options": { "style": "decimal", "useGrouping": true } }, "min": 0, "max": 100, "label": "% of Traffic" } } }, "conditionalVisibility": { "parameterName": "subpanel", "comparison": "isEqualTo", "value": "tags" }, "name": "query - 11" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, Datasets: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutTopAsnsByIP\r\n| where IP == ('{IndicatorValue}')\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| mv-expand todynamic(Datasets)\r\n| parse-where tostring(Datasets) with * '\"label\":\"' label '\",\"tag_id\":' tag_id ',\"data\":' data ',\"css_color\":\"' css_color '\",\"dates\":' Dates '}'\r\n| project data, label, Dates, IP\r\n| mv-expand todynamic(data), todynamic(Dates)\r\n| extend Date = format_datetime( todatetime(Dates), \"yyyy-MM-dd\")\r\n| summarize counts = sum(todouble(data)) by Date, keyword = tostring(label)", "size": 0, "aggregation": 2, "showAnalytics": true, "title": "Top 10 ASNs and Its Peers", "noDataMessage": "No Asns found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "Date", "yAxis": [ "counts" ], "group": "keyword", "showLegend": true, "xSettings": { "label": "Date" }, "ySettings": { "numberFormatSettings": { "unit": 1, "options": { "style": "decimal", "useGrouping": true } }, "min": 0, "max": 100, "label": "% of Traffic" } } }, "conditionalVisibility": { "parameterName": "subpanel", "comparison": "isEqualTo", "value": "asns" }, "name": "query - 12" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, Datasets: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutTopCountryCodesByIP\r\n| where IP == ('{IndicatorValue}')\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| mv-expand todynamic(Datasets)\r\n| parse-where tostring(Datasets) with * '\"label\":\"' label '\",\"tag_id\":' tag_id ',\"data\":' data ',\"country\":' Country ',\"css_color\":\"' css_color '\",\"dates\":' Dates '}'\r\n| project data, label, Dates, IP, Country\r\n| mv-expand todynamic(data), todynamic(Dates)\r\n| extend Date = format_datetime( todatetime(Dates), \"yyyy-MM-dd\")\r\n| summarize counts = sum(todouble(data)) by Date, keyword = tostring(Country)", "size": 0, "aggregation": 2, "showAnalytics": true, "title": "Top 10 Countries and Its Peers", "noDataMessage": "No Countries found", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "barchart", "chartSettings": { "xAxis": "Date", "yAxis": [ "counts" ], "group": "keyword", "createOtherGroup": 0, "showLegend": true, "xSettings": { "label": "Date" }, "ySettings": { "numberFormatSettings": { "unit": 1, "options": { "style": "decimal", "useGrouping": true } }, "min": 0, "max": 100, "label": "% of Traffic" } } }, "conditionalVisibility": { "parameterName": "subpanel", "comparison": "isEqualTo", "value": "countries" }, "name": "query - 13" } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "summary" }, "name": "group - 4" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, Modified: string, Asn: real, Cidr: string, ['As Name']: string, ['Bgp Asn']: real, ['Bgp Asn Name']: string, ['Net Name']: string, CC: string, Description: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutWhois\r\n| where IP == ('{IndicatorValue}')\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| project Modified = coalesce(Modified, \"-\"), ASN = Asn, CIDR = coalesce(Cidr, \"-\"), ['AS Name'] = coalesce(['As Name'], \"-\"), ['BGP ASN'] = ['Bgp Asn'], ['BGP AS Name'] = coalesce(['Bgp Asn Name'], \"-\"), ['Net Name'] = coalesce(['Net Name'], \"-\"), CC = coalesce(CC, \"-\"), Description = coalesce(Description, \"-\")", "size": 3, "showAnalytics": true, "title": "General", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 0", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, ['Admin Contact Id']: string, ['Admin Contact Role']: string, ['Admin Contact Email']: string, ['Admin Contact Phone']: string, ['Admin Contact Country']: string, ['Admin Contact Address']: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutWhois\r\n| where IP == ('{IndicatorValue}')\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| project ['Admin Cotact ID'] = coalesce(['Admin Contact Id'], \"-\"),\r\n ['Admin Contact Role'] = coalesce(['Admin Contact Role'], \"-\"),\r\n ['Admin Contact Email'] = coalesce(['Admin Contact Email'], \"-\"),\r\n ['Admin Contact Phone'] = coalesce(['Admin Contact Phone'], \"-\"),\r\n ['Admin Contact Country'] = coalesce(['Admin Contact Country'], \"-\"),\r\n ['Admin Contact Address'] = coalesce(['Admin Contact Address'], \"-\")", "size": 3, "showAnalytics": true, "title": "Admin", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 1", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, ['Tech Contact Id']: string, ['Tech Contact Role']: string, ['Tech Contact Email']: string, ['Tech Contact Phone']: string, ['Tech Contact Country']: string, ['Tech Contact Address']: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutWhois\r\n| where IP == ('{IndicatorValue}')\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| project ['Tech Contact ID'] = coalesce(['Tech Contact Id'], \"-\"),\r\n ['Tech Contact Role'] = coalesce(['Tech Contact Role'], \"-\"),\r\n ['Tech Contact Email'] = coalesce(['Tech Contact Email'], \"-\"),\r\n ['Tech Contact Phone'] = coalesce(['Tech Contact Phone'], \"-\"),\r\n ['Tech Contact Country'] = coalesce(['Tech Contact Country'], \"-\"),\r\n ['Tech Contact Address'] = coalesce(['Tech Contact Address'], \"-\")", "size": 3, "showAnalytics": true, "title": "Tech", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 2", "styleSettings": { "showBorder": true } }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "let dummy_table = datatable(TimeGenerated: datetime, IP: string, ['Org Id']: string, ['Org Name']: string, ['Org Email']: string, ['Org Phone']: string, ['Org Country']: string, ['Org Address']: string, ['Mnt By Email']: string, ['Mnt Router Email']: string) [];\r\nunion isfuzzy=true dummy_table,\r\nCymruScoutWhois\r\n| where IP == ('{IndicatorValue}')\r\n| summarize arg_max(TimeGenerated, *) by IP\r\n| project ['Organization ID'] = coalesce(['Org Id'], \"-\"),\r\n ['Organization Name'] = coalesce(['Org Name'], \"-\"),\r\n ['Organization Email'] = coalesce(['Org Email'], \"-\"),\r\n ['Organization Phone'] = coalesce(['Org Phone'], \"-\"),\r\n ['Organization Country'] = coalesce(['Org Country'], \"-\"),\r\n ['Organization Address'] = coalesce(['Org Address'], \"-\"),\r\n ['Maintained by Email'] = coalesce(['Mnt By Email'], \"-\"),\r\n ['Maintained by Router Email'] = coalesce(['Mnt Router Email'], \"-\")", "size": 3, "showAnalytics": true, "title": "Organization", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "visualization": "table", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 3", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "whois" }, "name": "group - 2" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CymruScoutCommunicationsData\r\n| where IP == \"{IndicatorValue}\"\r\n| extend [\"Client Ports\"] = strcat(toint([\"Peer Min Port\"]), \"-\", toint([\"Peer Max Port\"]), \"(\", toint([\"Peer Unique Ports\"]), \")\")\r\n| mv-expand\r\n todynamic([\"Peer Tags\"]),\r\n todynamic([\"Local Tags\"]),\r\n todynamic([\"Local Top Services\"]),\r\n todynamic([\"Peer As Info\"]),\r\n todynamic([\"Local As Info\"])\r\n| extend\r\n [\"Client Tags\"] = [\"Peer Tags\"][\"name\"],\r\n [\"Server Tags\"] = [\"Local Tags\"][\"name\"],\r\n [\"Server Ports\"] = [\"Local Top Services\"][\"port\"],\r\n [\"Client BGP AS Name\"] = split([\"Peer As Info\"][\"as_name\"], \", \"),\r\n [\"Server BGP AS Name\"] = split([\"Local As Info\"][\"as_name\"], \", \")\r\n| summarize\r\n [\"Client Tags\"] = make_list_if([\"Client Tags\"], isnotempty([\"Client Tags\"])),\r\n [\"Server Tags\"] = make_list_if([\"Server Tags\"], isnotempty([\"Server Tags\"])),\r\n [\"Server Ports\"] = make_list_if([\"Server Ports\"], isnotempty([\"Server Ports\"])),\r\n [\"Client BGP AS Name\"] = make_set_if([\"Client BGP AS Name\"], isnotempty([\"Client BGP AS Name\"][0])),\r\n [\"Server BGP AS Name\"] = make_set_if([\"Server BGP AS Name\"], isnotempty([\"Server BGP AS Name\"][0]))\r\n by\r\n [\"Proto Text\"],\r\n [\"Peer IP\"],\r\n [\"Peer Country Codes\"],\r\n [\"Client Ports\"],\r\n [\"Local Country Codes\"],\r\n [\"Event Count\"],\r\n [\"First Seen\"],\r\n [\"Last Seen\"],\r\n [\"Local IP\"]\r\n| extend\r\n [\"Client Tags\"] = strcat_array([\"Client Tags\"], \", \"),\r\n [\"Server Tags\"] = strcat_array([\"Server Tags\"], \", \"),\r\n [\"Client CC\"] = strcat_array(todynamic([\"Peer Country Codes\"]), \", \"),\r\n [\"Server Ports\"] = strcat_array([\"Server Ports\"], \", \"),\r\n [\"Server CC\"] = strcat_array(todynamic([\"Local Country Codes\"]), \", \"),\r\n [\"Client BGP AS Name\"] = strcat_array([\"Client BGP AS Name\"], \", \"),\r\n [\"Server BGP AS Name\"] = strcat_array([\"Server BGP AS Name\"], \", \") \r\n| project\r\n Proto = [\"Proto Text\"],\r\n [\"Client IP\"] = [\"Peer IP\"],\r\n [\"Client Tags\"],\r\n [\"Client CC\"],\r\n [\"Client Ports\"],\r\n [\"Server Ports\"],\r\n [\"Server IP\"] = [\"Local IP\"],\r\n [\"Server Tags\"],\r\n [\"Server CC\"],\r\n Count = [\"Event Count\"],\r\n [\"First Seen\"] = [\"First Seen\"],\r\n [\"Last Seen\"] = [\"Last Seen\"],\r\n [\"Client BGP AS Name\"],\r\n [\"Server BGP AS Name\"]", "size": 0, "showAnalytics": true, "title": "Communication Details", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 0", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "communications" }, "name": "group - communication tab" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CymruScoutPdnsData\r\n| where IP == \"{IndicatorValue}\"\r\n| mv-expand todynamic([\"Name Servers\"])\r\n| extend names = [\"Name Servers\"][\"nameservers\"]\r\n| summarize [\"Name Server\"] = make_set(names)\r\n by\r\n Domain,\r\n Root,\r\n Type,\r\n [\"First Seen\"],\r\n [\"Last Seen\"],\r\n [\"Event Count\"],\r\n [\"Active Days\"],\r\n [\"Distinct IPs\"],\r\n [\"Domain Created\"],\r\n [\"Domain Expires\"],\r\n Registrar\r\n| extend\r\n [\"Name Server\"] = strcat_array([\"Name Server\"], \", \")\r\n| project\r\n Domain,\r\n Root,\r\n Type,\r\n [\"First Seen\"],\r\n [\"Last Seen\"],\r\n Count = [\"Event Count\"],\r\n Days = [\"Active Days\"],\r\n [\"Resolved IPs\"] = [\"Distinct IPs\"],\r\n [\"Domain Created\"],\r\n [\"Domain Expires\"],\r\n Registrar,\r\n [\"Name Server\"]", "size": 0, "showAnalytics": true, "title": "PDNS Details", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 0", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "pdns" }, "name": "group - pdns tab" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CymruScoutX509Data\r\n| where IP == \"{IndicatorValue}\"\r\n| extend [\"Alt Names\"] = strcat_array(todynamic([\"Alt Names\"]), \", \")\r\n| project\r\n Port,\r\n [\"First Seen\"],\r\n [\"Last Seen\"],\r\n Subject,\r\n MD5,\r\n SHA1,\r\n SHA256,\r\n [\"Alt Names\"],\r\n [\"Not Before\"],\r\n [\"Not After\"],\r\n Validity = [\"Validity Period\"],\r\n Issuer", "size": 0, "showAnalytics": true, "title": "X.509 Details", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 0", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "x509" }, "name": "group - x509 tab" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CymruScoutFingerprintsData\r\n| where IP == \"{IndicatorValue}\"\r\n| project\r\n Type = toupper(Type),\r\n Fingerprint,\r\n Port,\r\n [\"First Seen\"],\r\n [\"Last Seen\"],\r\n [\"Active Days\"],\r\n Count = [\"Event Count\"],\r\n [\"Distinct IPs\"]", "size": 0, "showAnalytics": true, "title": "Fingerprint Details", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 0", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "fingerprints" }, "name": "group - fingerprints tab" }, { "type": 12, "content": { "version": "NotebookGroup/1.0", "groupType": "editable", "items": [ { "type": 9, "content": { "version": "KqlParameterItem/1.0", "parameters": [ { "id": "74fd4c29-76cb-409a-9e30-059dda180f7c", "version": "KqlParameterItem/1.0", "name": "Service", "type": 2, "isRequired": true, "quote": "'", "delimiter": ",", "query": "CymruScoutOpenPortsData\r\n| where IP == \"{IndicatorValue}\" and\r\n isnotempty(Service)\r\n| extend Service = toupper(Service)\r\n| distinct Service\r\n| sort by Service asc ", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "da298faf-a83f-4b84-9094-3aed57497347", "version": "KqlParameterItem/1.0", "name": "Port", "type": 2, "isRequired": true, "quote": "'", "delimiter": ",", "query": "CymruScoutOpenPortsData\r\n| where IP == \"{IndicatorValue}\" and\r\n ('*' == ('{Service}') or toupper(Service) == ('{Service}')) and\r\n isnotempty(Port)\r\n| distinct Port\r\n| sort by Port asc ", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" }, { "id": "9c5e6cdb-9a2c-422e-8c29-046e128e95b3", "version": "KqlParameterItem/1.0", "name": "Protocol", "type": 2, "isRequired": true, "quote": "'", "delimiter": ",", "query": "CymruScoutOpenPortsData\r\n| where IP == \"{IndicatorValue}\" and\r\n ('*' == ('{Service}') or toupper(Service) == ('{Service}')) and\r\n ('*' == ('{Port}') or Port == ('{Port}')) and\r\n isnotempty([\"Protocol Text\"])\r\n| distinct [\"Protocol Text\"]\r\n| sort by [\"Protocol Text\"] asc ", "typeSettings": { "additionalResourceOptions": [ "value::all" ], "selectAllValue": "*", "showDefault": false }, "timeContext": { "durationMs": 0 }, "timeContextFromParameter": "TimeRange", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "value": "value::all" } ], "style": "pills", "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces" }, "name": "parameters - 1" }, { "type": 3, "content": { "version": "KqlItem/1.0", "query": "CymruScoutOpenPortsData\r\n| where IP == \"{IndicatorValue}\" and\r\n ('*' == ('{Service}') or toupper(Service) == ('{Service}')) and\r\n ('*' == ('{Port}') or Port == ('{Port}')) and\r\n ('*' == ('{Protocol}') or [\"Protocol Text\"] == ('{Protocol}'))\r\n| project\r\n Port,\r\n [\"First Seen\"],\r\n [\"Last Seen\"],\r\n Count = [\"Event Count\"],\r\n Proto = [\"Protocol Text\"],\r\n Service,\r\n Banner,\r\n [\"Banner Length\"] = strlen(Banner),\r\n [\"Banner Hash\"] = [\"Banner SHA1\"]", "size": 0, "showAnalytics": true, "title": "Open Ports Details", "timeContextFromParameter": "TimeRange", "showRefreshButton": true, "showExportToExcel": true, "queryType": 0, "resourceType": "microsoft.operationalinsights/workspaces", "gridSettings": { "rowLimit": 10000, "filter": true } }, "name": "query - 0", "styleSettings": { "showBorder": true } } ] }, "conditionalVisibility": { "parameterName": "tab", "comparison": "isEqualTo", "value": "openports" }, "name": "group - open ports tab" } ] }, "conditionalVisibilities": [ { "parameterName": "IndicatorType", "comparison": "isNotEqualTo", "value": "Domain" }, { "parameterName": "IndicatorValue", "comparison": "isNotEqualTo" } ], "name": "group - investigated ip" }, { "type": 1, "content": { "json": "📝***Refresh the web page to fetch details of recently collected events***" }, "name": "text - 2" } ] }, "conditionalVisibility": { "parameterName": "dashboard", "comparison": "isEqualTo", "value": "InvestigatedIndicators" }, "name": "group - investigated indicators tab" } ], "fromTemplateId": "sentinel-TeamCymruScoutWorkbook", "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json" }